Merge branch 'upstream-fixes' into upstream

Conflicts:

	drivers/scsi/libata-core.c

18 files changed, 188 insertions, 127 deletions

diff --git a/net/802/tr.c b/net/802/tr.c
index afd8385c0c9c..e9dc803f2fe0 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -643,6 +643,5 @@ static int __init rif_init(void)
 
 module_init(rif_init);
 
-EXPORT_SYMBOL(tr_source_route);
 EXPORT_SYMBOL(tr_type_trans);
 EXPORT_SYMBOL(alloc_trdev);
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index d159c92cca84..466ed3440b74 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -168,7 +168,7 @@ static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
 
         if (info->bitmask & EBT_LOG_NFLOG)
                 nf_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li,
-                              info->prefix);
+                              "%s", info->prefix);
         else
                 ebt_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li,
                                info->prefix);
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index c2d92f99a2b8..d0d19192026d 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -948,7 +948,7 @@ static int do_add_counters(void __user *user, unsigned int len)
 
         write_lock_bh(&t->lock);
         private = t->private;
-        if (private->number != paddc->num_counters) {
+        if (private->number != tmp.num_counters) {
                 ret = -EINVAL;
                 goto unlock_up_free;
         }
diff --git a/net/ipv4/netfilter/ip_nat_proto_gre.c b/net/ipv4/netfilter/ip_nat_proto_gre.c
index 6c4899d8046a..96ceabaec402 100644
--- a/net/ipv4/netfilter/ip_nat_proto_gre.c
+++ b/net/ipv4/netfilter/ip_nat_proto_gre.c
@@ -49,15 +49,15 @@ gre_in_range(const struct ip_conntrack_tuple *tuple,
              const union ip_conntrack_manip_proto *min,
              const union ip_conntrack_manip_proto *max)
 {
-        u_int32_t key;
+        __be16 key;
 
         if (maniptype == IP_NAT_MANIP_SRC)
                 key = tuple->src.u.gre.key;
         else
                 key = tuple->dst.u.gre.key;
 
-        return ntohl(key) >= ntohl(min->gre.key)
-                && ntohl(key) <= ntohl(max->gre.key);
+        return ntohs(key) >= ntohs(min->gre.key)
+                && ntohs(key) <= ntohs(max->gre.key);
 }
 
 /* generate unique tuple ... */
@@ -81,14 +81,14 @@ gre_unique_tuple(struct ip_conntrack_tuple *tuple,
                 min = 1;
                 range_size = 0xffff;
         } else {
-                min = ntohl(range->min.gre.key);
-                range_size = ntohl(range->max.gre.key) - min + 1;
+                min = ntohs(range->min.gre.key);
+                range_size = ntohs(range->max.gre.key) - min + 1;
         }
 
         DEBUGP("min = %u, range_size = %u\n", min, range_size); 
 
         for (i = 0; i < range_size; i++, key++) {
-                *keyptr = htonl(min + key % range_size);
+                *keyptr = htons(min + key % range_size);
                 if (!ip_nat_used_tuple(tuple, conntrack))
                         return 1;
         }
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index 39fd4c2a2386..b98f7b08b084 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -428,7 +428,7 @@ ipt_log_target(struct sk_buff **pskb,
 
         if (loginfo->logflags & IPT_LOG_NFLOG)
                 nf_log_packet(PF_INET, hooknum, *pskb, in, out, &li,
-                              loginfo->prefix);
+                              "%s", loginfo->prefix);
         else
                 ipt_log_packet(PF_INET, hooknum, *pskb, in, out, &li,
                                loginfo->prefix);
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 143843285702..b847ee409efb 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -821,6 +821,7 @@ checkentry(const char *tablename,
         /* Create our proc 'status' entry. */
         curr_table->status_proc = create_proc_entry(curr_table->name, ip_list_perms, proc_net_ipt_recent);
         if (!curr_table->status_proc) {
+                vfree(hold);
                 printk(KERN_INFO RECENT_NAME ": checkentry: unable to allocate for /proc entry.\n");
                 /* Destroy the created table */
                 spin_lock_bh(&recent_lock);
@@ -845,7 +846,6 @@ checkentry(const char *tablename,
                 spin_unlock_bh(&recent_lock);
                 vfree(curr_table->time_info);
                 vfree(curr_table->hash_table);
-                vfree(hold);
                 vfree(curr_table->table);
                 vfree(curr_table);
                 return 0;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 9f0cca4c4fae..4a538bc1683d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1662,6 +1662,8 @@ static void tcp_update_scoreboard(struct sock *sk, struct tcp_sock *tp)
                         if (!(TCP_SKB_CB(skb)->sacked&TCPCB_TAGBITS)) {
                                 TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
                                 tp->lost_out += tcp_skb_pcount(skb);
+                                if (IsReno(tp))
+                                        tcp_remove_reno_sacks(sk, tp, tcp_skb_pcount(skb) + 1);
 
                                 /* clear xmit_retrans hint */
                                 if (tp->retransmit_skb_hint &&
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 0a673038344f..2e72f89a7019 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1103,7 +1103,7 @@ do_add_counters(void __user *user, unsigned int len)
 
         write_lock_bh(&t->lock);
         private = t->private;
-        if (private->number != paddc->num_counters) {
+        if (private->number != tmp.num_counters) {
                 ret = -EINVAL;
                 goto unlock_up_free;
         }
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index a96c0de14b00..73c6300109d6 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -439,7 +439,7 @@ ip6t_log_target(struct sk_buff **pskb,
 
         if (loginfo->logflags & IP6T_LOG_NFLOG)
                 nf_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
-                              loginfo->prefix);
+                              "%s", loginfo->prefix);
         else
                 ip6t_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
                                 loginfo->prefix);
diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c
index 94dbdb8b458d..4f6b84c8f4ab 100644
--- a/net/ipv6/netfilter/ip6t_eui64.c
+++ b/net/ipv6/netfilter/ip6t_eui64.c
@@ -40,7 +40,7 @@ match(const struct sk_buff *skb,
 
         memset(eui64, 0, sizeof(eui64));
 
-        if (eth_hdr(skb)->h_proto == ntohs(ETH_P_IPV6)) {
+        if (eth_hdr(skb)->h_proto == htons(ETH_P_IPV6)) {
                 if (skb->nh.ipv6h->version == 0x6) {
                         memcpy(eui64, eth_hdr(skb)->h_source, 3);
                         memcpy(eui64 + 5, eth_hdr(skb)->h_source + 3, 3);
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 2dbf134d5266..811d998725bc 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -944,9 +944,9 @@ out:
         return rc;
 }
 
-static int ipx_map_frame_type(unsigned char type)
+static __be16 ipx_map_frame_type(unsigned char type)
 {
-        int rc = 0;
+        __be16 rc = 0;
 
         switch (type) {
         case IPX_FRAME_ETHERII: rc = htons(ETH_P_IPX);          break;
diff --git a/net/ipx/ipx_route.c b/net/ipx/ipx_route.c
index 67774448efd9..a394c6fe19a2 100644
--- a/net/ipx/ipx_route.c
+++ b/net/ipx/ipx_route.c
@@ -119,7 +119,7 @@ out:
         return rc;
 }
 
-static int ipxrtr_delete(long net)
+static int ipxrtr_delete(__u32 net)
 {
         struct ipx_route *r, *tmp;
         int rc;
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index c60273cad778..61cdda4e5d3b 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -321,7 +321,7 @@ static int
 nfulnl_set_flags(struct nfulnl_instance *inst, u_int16_t flags)
 {
         spin_lock_bh(&inst->lock);
-        inst->flags = ntohs(flags);
+        inst->flags = flags;
         spin_unlock_bh(&inst->lock);
 
         return 0;
@@ -902,7 +902,7 @@ nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
         if (nfula[NFULA_CFG_FLAGS-1]) {
                 u_int16_t flags =
                         *(u_int16_t *)NFA_DATA(nfula[NFULA_CFG_FLAGS-1]);
-                nfulnl_set_flags(inst, ntohl(flags));
+                nfulnl_set_flags(inst, ntohs(flags));
         }
 
 out_put:
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 31eb83717c26..138ea92ed268 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -193,8 +193,10 @@ static void dev_watchdog(unsigned long arg)
                     netif_running(dev) &&
                     netif_carrier_ok(dev)) {
                         if (netif_queue_stopped(dev) &&
-                            (jiffies - dev->trans_start) > dev->watchdog_timeo) {
-                                printk(KERN_INFO "NETDEV WATCHDOG: %s: transmit timed out\n", dev->name);
+                            time_after(jiffies, dev->trans_start + dev->watchdog_timeo)) {
+
+                                printk(KERN_INFO "NETDEV WATCHDOG: %s: transmit timed out\n",
+                                       dev->name);
                                 dev->tx_timeout(dev);
                         }
                         if (!mod_timer(&dev->watchdog_timer, jiffies + dev->watchdog_timeo))
diff --git a/net/sctp/input.c b/net/sctp/input.c
index d117ebc75cf8..1662f9cc869e 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -73,6 +73,8 @@ static struct sctp_association *__sctp_lookup_association(
                                         const union sctp_addr *peer,
                                         struct sctp_transport **pt);
 
+static void sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
+
 
 /* Calculate the SCTP checksum of an SCTP packet.  */
 static inline int sctp_rcv_checksum(struct sk_buff *skb)
@@ -186,7 +188,6 @@ int sctp_rcv(struct sk_buff *skb)
          */
         if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif(skb)))
         {
-                sock_put(sk);
                 if (asoc) {
                         sctp_association_put(asoc);
                         asoc = NULL;
@@ -197,7 +198,6 @@ int sctp_rcv(struct sk_buff *skb)
                 sk = sctp_get_ctl_sock();
                 ep = sctp_sk(sk)->ep;
                 sctp_endpoint_hold(ep);
-                sock_hold(sk);
                 rcvr = &ep->base;
         }
 
@@ -253,25 +253,18 @@ int sctp_rcv(struct sk_buff *skb)
          */
         sctp_bh_lock_sock(sk);
 
-        /* It is possible that the association could have moved to a different
-         * socket if it is peeled off. If so, update the sk.
-         */ 
-        if (sk != rcvr->sk) {
-                sctp_bh_lock_sock(rcvr->sk);
-                sctp_bh_unlock_sock(sk);
-                sk = rcvr->sk;
-        }
-
         if (sock_owned_by_user(sk))
-                sk_add_backlog(sk, skb);
+                sctp_add_backlog(sk, skb);
         else
-                sctp_backlog_rcv(sk, skb);
+                sctp_inq_push(&chunk->rcvr->inqueue, chunk);
 
-        /* Release the sock and the sock ref we took in the lookup calls.
-         * The asoc/ep ref will be released in sctp_backlog_rcv.
-         */
         sctp_bh_unlock_sock(sk);
-        sock_put(sk);
+
+        /* Release the asoc/ep ref we took in the lookup calls. */
+        if (asoc)
+                sctp_association_put(asoc);
+        else
+                sctp_endpoint_put(ep);
 
         return 0;
 
@@ -280,8 +273,7 @@ discard_it:
         return 0;
 
 discard_release:
-        /* Release any structures we may be holding. */
-        sock_put(sk);
+        /* Release the asoc/ep ref we took in the lookup calls. */
         if (asoc)
                 sctp_association_put(asoc);
         else
@@ -290,56 +282,87 @@ discard_release:
         goto discard_it;
 }
 
-/* Handle second half of inbound skb processing.  If the sock was busy,
- * we may have need to delay processing until later when the sock is
- * released (on the backlog).   If not busy, we call this routine
- * directly from the bottom half.
+/* Process the backlog queue of the socket.  Every skb on
+ * the backlog holds a ref on an association or endpoint.
+ * We hold this ref throughout the state machine to make
+ * sure that the structure we need is still around.
  */
 int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
         struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
-        struct sctp_inq *inqueue = NULL;
+        struct sctp_inq *inqueue = &chunk->rcvr->inqueue;
         struct sctp_ep_common *rcvr = NULL;
+        int backloged = 0;
 
         rcvr = chunk->rcvr;
 
-        BUG_TRAP(rcvr->sk == sk);
-
-        if (rcvr->dead) {
-                sctp_chunk_free(chunk);
-        } else {
-                inqueue = &chunk->rcvr->inqueue;
-                sctp_inq_push(inqueue, chunk);
-        }
-
-        /* Release the asoc/ep ref we took in the lookup calls in sctp_rcv. */ 
-        if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
-                sctp_association_put(sctp_assoc(rcvr));
-        else
-                sctp_endpoint_put(sctp_ep(rcvr));
-  
+        /* If the rcvr is dead then the association or endpoint
+         * has been deleted and we can safely drop the chunk
+         * and refs that we are holding.
+         */
+        if (rcvr->dead) {
+                sctp_chunk_free(chunk);
+                goto done;
+        }
+
+        if (unlikely(rcvr->sk != sk)) {
+                /* In this case, the association moved from one socket to
+                 * another.  We are currently sitting on the backlog of the
+                 * old socket, so we need to move.
+                 * However, since we are here in the process context we
+                 * need to take make sure that the user doesn't own
+                 * the new socket when we process the packet.
+                 * If the new socket is user-owned, queue the chunk to the
+                 * backlog of the new socket without dropping any refs.
+                 * Otherwise, we can safely push the chunk on the inqueue.
+                 */
+
+                sk = rcvr->sk;
+                sctp_bh_lock_sock(sk);
+
+                if (sock_owned_by_user(sk)) {
+                        sk_add_backlog(sk, skb);
+                        backloged = 1;
+                } else
+                        sctp_inq_push(inqueue, chunk);
+
+                sctp_bh_unlock_sock(sk);
+
+                /* If the chunk was backloged again, don't drop refs */
+                if (backloged)
+                        return 0;
+        } else {
+                sctp_inq_push(inqueue, chunk);
+        }
+
+done:
+        /* Release the refs we took in sctp_add_backlog */
+        if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
+                sctp_association_put(sctp_assoc(rcvr));
+        else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
+                sctp_endpoint_put(sctp_ep(rcvr));
+        else
+                BUG();
+
         return 0;
 }
 
-void sctp_backlog_migrate(struct sctp_association *assoc, 
-                          struct sock *oldsk, struct sock *newsk)
+static void sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
 {
-        struct sk_buff *skb;
-        struct sctp_chunk *chunk;
+        struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
+        struct sctp_ep_common *rcvr = chunk->rcvr;
 
-        skb = oldsk->sk_backlog.head;
-        oldsk->sk_backlog.head = oldsk->sk_backlog.tail = NULL;
-        while (skb != NULL) {
-                struct sk_buff *next = skb->next;
-
-                chunk = SCTP_INPUT_CB(skb)->chunk;
-                skb->next = NULL;
-                if (&assoc->base == chunk->rcvr)
-                        sk_add_backlog(newsk, skb);
-                else
-                        sk_add_backlog(oldsk, skb);
-                skb = next;
-        }
+        /* Hold the assoc/ep while hanging on the backlog queue.
+         * This way, we know structures we need will not disappear from us
+         */
+        if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
+                sctp_association_hold(sctp_assoc(rcvr));
+        else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
+                sctp_endpoint_hold(sctp_ep(rcvr));
+        else
+                BUG();
+
+        sk_add_backlog(sk, skb);
 }
 
 /* Handle icmp frag needed error. */
@@ -412,7 +435,7 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
         union sctp_addr daddr;
         struct sctp_af *af;
         struct sock *sk = NULL;
-        struct sctp_association *asoc = NULL;
+        struct sctp_association *asoc;
         struct sctp_transport *transport = NULL;
 
         *app = NULL; *tpp = NULL;
@@ -453,7 +476,6 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
         return sk;
 
 out:
-        sock_put(sk);
         if (asoc)
                 sctp_association_put(asoc);
         return NULL;
@@ -463,7 +485,6 @@ out:
 void sctp_err_finish(struct sock *sk, struct sctp_association *asoc)
 {
         sctp_bh_unlock_sock(sk);
-        sock_put(sk);
         if (asoc)
                 sctp_association_put(asoc);
 }
@@ -490,7 +511,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         int type = skb->h.icmph->type;
         int code = skb->h.icmph->code;
         struct sock *sk;
-        struct sctp_association *asoc;
+        struct sctp_association *asoc = NULL;
         struct sctp_transport *transport;
         struct inet_sock *inet;
         char *saveip, *savesctp;
@@ -716,7 +737,6 @@ static struct sctp_endpoint *__sctp_rcv_lookup_endpoint(const union sctp_addr *l
 
 hit:
         sctp_endpoint_hold(ep);
-        sock_hold(epb->sk);
         read_unlock(&head->lock);
         return ep;
 }
@@ -818,7 +838,6 @@ static struct sctp_association *__sctp_lookup_association(
 hit:
         *pt = transport;
         sctp_association_hold(asoc);
-        sock_hold(epb->sk);
         read_unlock(&head->lock);
         return asoc;
 }
@@ -846,7 +865,6 @@ int sctp_has_association(const union sctp_addr *laddr,
         struct sctp_transport *transport;
 
         if ((asoc = sctp_lookup_association(laddr, paddr, &transport))) {
-                sock_put(asoc->base.sk);
                 sctp_association_put(asoc);
                 return 1;
         }
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 8d1dc24bab4c..c5beb2ad7ef7 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -498,10 +498,6 @@ static void sctp_cmd_assoc_failed(sctp_cmd_seq_t *commands,
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_CLOSED));
 
-        /* Set sk_err to ECONNRESET on a 1-1 style socket. */
-        if (!sctp_style(asoc->base.sk, UDP))
-                asoc->base.sk->sk_err = ECONNRESET; 
-
         /* SEND_FAILED sent later when cleaning up the association. */
         asoc->outqueue.error = error;
         sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
@@ -838,6 +834,15 @@ static void sctp_cmd_del_non_primary(struct sctp_association *asoc)
         return;
 }
 
+/* Helper function to set sk_err on a 1-1 style socket. */
+static void sctp_cmd_set_sk_err(struct sctp_association *asoc, int error)
+{
+        struct sock *sk = asoc->base.sk;
+
+        if (!sctp_style(sk, UDP))
+                sk->sk_err = error;
+}
+
 /* These three macros allow us to pull the debugging code out of the
  * main flow of sctp_do_sm() to keep attention focused on the real
  * functionality there.
@@ -1458,6 +1463,9 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                         local_cork = 0;
                         asoc->peer.retran_path = t;
                         break;
+                case SCTP_CMD_SET_SK_ERR:
+                        sctp_cmd_set_sk_err(asoc, cmd->obj.error);
+                        break;
                 default:
                         printk(KERN_WARNING "Impossible command: %u, %p\n",
                                cmd->verb, cmd->obj.ptr);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 8cdba51ec076..8bc279219a72 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -93,7 +93,7 @@ static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
 static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
 
 static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
-                                           __u16 error,
+                                           __u16 error, int sk_err,
                                            const struct sctp_association *asoc,
                                            struct sctp_transport *transport);
 
@@ -448,7 +448,7 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
         __u32 init_tag;
         struct sctp_chunk *err_chunk;
         struct sctp_packet *packet;
-        sctp_disposition_t ret;
+        __u16 error;
 
         if (!sctp_vtag_verify(chunk, asoc))
                 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -480,11 +480,9 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
                         goto nomem;
 
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
-                sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
-                                SCTP_STATE(SCTP_STATE_CLOSED));
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-                sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
-                return SCTP_DISPOSITION_DELETE_TCB;
+                return sctp_stop_t1_and_abort(commands, SCTP_ERROR_INV_PARAM,
+                                              ECONNREFUSED, asoc,
+                                              chunk->transport);
         }
 
         /* Verify the INIT chunk before processing it. */
@@ -511,27 +509,16 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
                                 sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
                                                 SCTP_PACKET(packet));
                                 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
-                                sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
-                                                SCTP_STATE(SCTP_STATE_CLOSED));
-                                sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB,
-                                                SCTP_NULL());
-                                return SCTP_DISPOSITION_CONSUME;
+                                error = SCTP_ERROR_INV_PARAM;
                         } else {
-                                sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
-                                                SCTP_STATE(SCTP_STATE_CLOSED));
-                                sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB,
-                                                SCTP_NULL());
-                                return SCTP_DISPOSITION_NOMEM;
+                                error = SCTP_ERROR_NO_RESOURCE;
                         }
                 } else {
-                        ret = sctp_sf_tabort_8_4_8(ep, asoc, type, arg,
-                                                   commands);
-                        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
-                                        SCTP_STATE(SCTP_STATE_CLOSED));
-                        sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB,
-                                        SCTP_NULL());
-                        return ret;
+                        sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
+                        error = SCTP_ERROR_INV_PARAM;
                 }
+                return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED,
+                                                asoc, chunk->transport);
         }
 
         /* Tag the variable length parameters.  Note that we never
@@ -886,6 +873,8 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
         struct sctp_transport *transport = (struct sctp_transport *) arg;
 
         if (asoc->overall_error_count >= asoc->max_retrans) {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_U32(SCTP_ERROR_NO_ERROR));
@@ -1030,6 +1019,12 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
                                                   commands);
 
         hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data;
+        /* Make sure that the length of the parameter is what we expect */
+        if (ntohs(hbinfo->param_hdr.length) !=
+                                    sizeof(sctp_sender_hb_info_t)) {
+                return SCTP_DISPOSITION_DISCARD;
+        }
+
         from_addr = hbinfo->daddr;
         link = sctp_assoc_lookup_paddr(asoc, &from_addr);
 
@@ -2126,6 +2121,8 @@ static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
         int attempts = asoc->init_err_counter + 1;
 
         if (attempts > asoc->max_init_attempts) {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                                 SCTP_U32(SCTP_ERROR_STALE_COOKIE));
                 return SCTP_DISPOSITION_DELETE_TCB;
@@ -2262,6 +2259,7 @@ sctp_disposition_t sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
         if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
                 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
 
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
         /* ASSOC_FAILED will DELETE_TCB. */
         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_U32(error));
         SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
@@ -2306,7 +2304,8 @@ sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
         if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
                 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
 
-        return sctp_stop_t1_and_abort(commands, error, asoc, chunk->transport);
+        return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED, asoc,
+                                      chunk->transport);
 }
 
 /*
@@ -2318,7 +2317,8 @@ sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(const struct sctp_endpoint *ep
                                         void *arg,
                                         sctp_cmd_seq_t *commands)
 {
-        return sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR, asoc,
+        return sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR,
+                                      ENOPROTOOPT, asoc,
                                       (struct sctp_transport *)arg);
 }
 
@@ -2343,7 +2343,7 @@ sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
  * This is common code called by several sctp_sf_*_abort() functions above.
  */
 static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
-                                           __u16 error,
+                                           __u16 error, int sk_err,
                                            const struct sctp_association *asoc,
                                            struct sctp_transport *transport)
 {
@@ -2353,6 +2353,7 @@ static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
         SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(sk_err));
         /* CMD_INIT_FAILED will DELETE_TCB. */
         sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                         SCTP_U32(error));
@@ -3336,6 +3337,8 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
                 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ECONNABORTED));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_U32(SCTP_ERROR_ASCONF_ACK));
                 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
@@ -3362,6 +3365,8 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
                  * processing the rest of the chunks in the packet.
                  */
                 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ECONNABORTED));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_U32(SCTP_ERROR_ASCONF_ACK));
                 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
@@ -3714,9 +3719,13 @@ static sctp_disposition_t sctp_sf_violation_chunklen(
         if (asoc->state <= SCTP_STATE_COOKIE_ECHOED) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ECONNREFUSED));
                 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                                 SCTP_U32(SCTP_ERROR_PROTO_VIOLATION));
         } else {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ECONNABORTED));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_U32(SCTP_ERROR_PROTO_VIOLATION));
                 SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
@@ -4034,6 +4043,8 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(
          * TCB.  This is a departure from our typical NOMEM handling.
          */
 
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                        SCTP_ERROR(ECONNABORTED));
         /* Delete the established association. */
         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                         SCTP_U32(SCTP_ERROR_USER_ABORT));
@@ -4175,6 +4186,8 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
          * TCB.  This is a departure from our typical NOMEM handling.
          */
 
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                        SCTP_ERROR(ECONNREFUSED));
         /* Delete the established association. */
         sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                         SCTP_U32(SCTP_ERROR_USER_ABORT));
@@ -4543,6 +4556,8 @@ sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
         struct sctp_transport *transport = arg;
 
         if (asoc->overall_error_count >= asoc->max_retrans) {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_U32(SCTP_ERROR_NO_ERROR));
@@ -4662,6 +4677,8 @@ sctp_disposition_t sctp_sf_t1_init_timer_expire(const struct sctp_endpoint *ep,
                 SCTP_DEBUG_PRINTK("Giving up on INIT, attempts: %d"
                                   " max_init_attempts: %d\n",
                                   attempts, asoc->max_init_attempts);
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                                 SCTP_U32(SCTP_ERROR_NO_ERROR));
                 return SCTP_DISPOSITION_DELETE_TCB;
@@ -4711,6 +4728,8 @@ sctp_disposition_t sctp_sf_t1_cookie_timer_expire(const struct sctp_endpoint *ep
 
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
         } else {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                                 SCTP_U32(SCTP_ERROR_NO_ERROR));
                 return SCTP_DISPOSITION_DELETE_TCB;
@@ -4742,6 +4761,8 @@ sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
 
         SCTP_DEBUG_PRINTK("Timer T2 expired.\n");
         if (asoc->overall_error_count >= asoc->max_retrans) {
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                 /* Note:  CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_U32(SCTP_ERROR_NO_ERROR));
@@ -4817,6 +4838,8 @@ sctp_disposition_t sctp_sf_t4_timer_expire(
         if (asoc->overall_error_count >= asoc->max_retrans) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ETIMEDOUT));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_U32(SCTP_ERROR_NO_ERROR));
                 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
@@ -4870,6 +4893,8 @@ sctp_disposition_t sctp_sf_t5_timer_expire(const struct sctp_endpoint *ep,
                 goto nomem;
 
         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                        SCTP_ERROR(ETIMEDOUT));
         sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                         SCTP_U32(SCTP_ERROR_NO_ERROR));
 
@@ -5309,6 +5334,8 @@ static int sctp_eat_data(const struct sctp_association *asoc,
                  * processing the rest of the chunks in the packet.
                  */
                 sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                SCTP_ERROR(ECONNABORTED));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_U32(SCTP_ERROR_NO_DATA));
                 SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index b6e4b89539b3..174d4d35e951 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1057,6 +1057,7 @@ static int __sctp_connect(struct sock* sk,
         inet_sk(sk)->dport = htons(asoc->peer.port);
         af = sctp_get_af_specific(to.sa.sa_family);
         af->to_sk_daddr(&to, sk);
+        sk->sk_err = 0;
 
         timeo = sock_sndtimeo(sk, sk->sk_socket->file->f_flags & O_NONBLOCK);
         err = sctp_wait_for_connect(asoc, &timeo);
@@ -1228,7 +1229,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
 
         ep = sctp_sk(sk)->ep;
 
-        /* Walk all associations on a socket, not on an endpoint.  */
+        /* Walk all associations on an endpoint.  */
         list_for_each_safe(pos, temp, &ep->asocs) {
                 asoc = list_entry(pos, struct sctp_association, asocs);
 
@@ -1241,13 +1242,13 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
                         if (sctp_state(asoc, CLOSED)) {
                                 sctp_unhash_established(asoc);
                                 sctp_association_free(asoc);
+                                continue;
+                        }
+                }
 
-                        } else if (sock_flag(sk, SOCK_LINGER) &&
-                                   !sk->sk_lingertime)
-                                sctp_primitive_ABORT(asoc, NULL);
-                        else
-                                sctp_primitive_SHUTDOWN(asoc, NULL);
-                } else
+                if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)
+                        sctp_primitive_ABORT(asoc, NULL);
+                else
                         sctp_primitive_SHUTDOWN(asoc, NULL);
         }
 
@@ -5317,6 +5318,7 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
                  */
                 sctp_release_sock(sk);
                 current_timeo = schedule_timeout(current_timeo);
+                BUG_ON(sk != asoc->base.sk);
                 sctp_lock_sock(sk);
 
                 *timeo_p = current_timeo;
@@ -5604,12 +5606,14 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
          */
         newsp->type = type;
 
-        spin_lock_bh(&oldsk->sk_lock.slock);
-        /* Migrate the backlog from oldsk to newsk. */
-        sctp_backlog_migrate(assoc, oldsk, newsk);
-        /* Migrate the association to the new socket. */
+        /* Mark the new socket "in-use" by the user so that any packets
+         * that may arrive on the association after we've moved it are
+         * queued to the backlog.  This prevents a potential race between
+         * backlog processing on the old socket and new-packet processing
+         * on the new socket.
+         */
+        sctp_lock_sock(newsk);
         sctp_assoc_migrate(assoc, newsk);
-        spin_unlock_bh(&oldsk->sk_lock.slock);
 
         /* If the association on the newsk is already closed before accept()
          * is called, set RCV_SHUTDOWN flag.
@@ -5618,6 +5622,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
                 newsk->sk_shutdown |= RCV_SHUTDOWN;
 
         newsk->sk_state = SCTP_SS_ESTABLISHED;
+        sctp_release_sock(newsk);
 }
 
 /* This proto struct describes the ULP interface for SCTP.  */