Merge remote-tracking branch 'asoc/topic/core' into asoc-next

18 files changed, 191 insertions, 83 deletions

diff --git a/net/can/bcm.c b/net/can/bcm.c
index 6f747582718e..969b7cdff59d 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1084,6 +1084,9 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                 op->sk = sk;
                 op->ifindex = ifindex;
 
+                /* ifindex for timeout events w/o previous frame reception */
+                op->rx_ifindex = ifindex;
+
                 /* initialize uninitialized (kzalloc) structure */
                 hrtimer_init(&op->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
                 op->timer.function = bcm_rx_timeout_handler;
diff --git a/net/core/dev.c b/net/core/dev.c
index c0946cb2b354..e5942bf45a6d 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3451,6 +3451,8 @@ static int napi_gro_complete(struct sk_buff *skb)
         struct list_head *head = &ptype_base[ntohs(type) & PTYPE_HASH_MASK];
         int err = -ENOENT;
 
+        BUILD_BUG_ON(sizeof(struct napi_gro_cb) > sizeof(skb->cb));
+
         if (NAPI_GRO_CB(skb)->count == 1) {
                 skb_shinfo(skb)->gso_size = 0;
                 goto out;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 4007c1437fda..3f0636cd76cd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3004,7 +3004,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         skb_shinfo(nskb)->gso_size = pinfo->gso_size;
         pinfo->gso_size = 0;
         skb_header_release(p);
-        nskb->prev = p;
+        NAPI_GRO_CB(nskb)->last = p;
 
         nskb->data_len += p->len;
         nskb->truesize += p->truesize;
@@ -3030,8 +3030,8 @@ merge:
 
         __skb_pull(skb, offset);
 
-        p->prev->next = skb;
-        p->prev = skb;
+        NAPI_GRO_CB(p)->last->next = skb;
+        NAPI_GRO_CB(p)->last = skb;
         skb_header_release(skb);
 
 done:
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index f2eccd531746..17ff9fd7cdda 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -257,7 +257,8 @@ static inline bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
                 struct inet_peer *peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, 1);
                 rc = inet_peer_xrlim_allow(peer,
                                            net->ipv4.sysctl_icmp_ratelimit);
-                inet_putpeer(peer);
+                if (peer)
+                        inet_putpeer(peer);
         }
 out:
         return rc;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 0c34bfabc11f..e23e16dc501d 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -44,6 +44,10 @@ struct inet_diag_entry {
         u16 dport;
         u16 family;
         u16 userlocks;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct in6_addr saddr_storage;  /* for IPv4-mapped-IPv6 addresses */
+        struct in6_addr daddr_storage;  /* for IPv4-mapped-IPv6 addresses */
+#endif
 };
 
 static DEFINE_MUTEX(inet_diag_table_mutex);
@@ -428,25 +432,31 @@ static int inet_diag_bc_run(const struct nlattr *_bc,
                                 break;
                         }
 
-                        if (cond->prefix_len == 0)
-                                break;
-
                         if (op->code == INET_DIAG_BC_S_COND)
                                 addr = entry->saddr;
                         else
                                 addr = entry->daddr;
 
+                        if (cond->family != AF_UNSPEC &&
+                            cond->family != entry->family) {
+                                if (entry->family == AF_INET6 &&
+                                    cond->family == AF_INET) {
+                                        if (addr[0] == 0 && addr[1] == 0 &&
+                                            addr[2] == htonl(0xffff) &&
+                                            bitstring_match(addr + 3,
+                                                            cond->addr,
+                                                            cond->prefix_len))
+                                                break;
+                                }
+                                yes = 0;
+                                break;
+                        }
+
+                        if (cond->prefix_len == 0)
+                                break;
                         if (bitstring_match(addr, cond->addr,
                                             cond->prefix_len))
                                 break;
-                        if (entry->family == AF_INET6 &&
-                            cond->family == AF_INET) {
-                                if (addr[0] == 0 && addr[1] == 0 &&
-                                    addr[2] == htonl(0xffff) &&
-                                    bitstring_match(addr + 3, cond->addr,
-                                                    cond->prefix_len))
-                                        break;
-                        }
                         yes = 0;
                         break;
                 }
@@ -509,6 +519,55 @@ static int valid_cc(const void *bc, int len, int cc)
         return 0;
 }
 
+/* Validate an inet_diag_hostcond. */
+static bool valid_hostcond(const struct inet_diag_bc_op *op, int len,
+                           int *min_len)
+{
+        int addr_len;
+        struct inet_diag_hostcond *cond;
+
+        /* Check hostcond space. */
+        *min_len += sizeof(struct inet_diag_hostcond);
+        if (len < *min_len)
+                return false;
+        cond = (struct inet_diag_hostcond *)(op + 1);
+
+        /* Check address family and address length. */
+        switch (cond->family) {
+        case AF_UNSPEC:
+                addr_len = 0;
+                break;
+        case AF_INET:
+                addr_len = sizeof(struct in_addr);
+                break;
+        case AF_INET6:
+                addr_len = sizeof(struct in6_addr);
+                break;
+        default:
+                return false;
+        }
+        *min_len += addr_len;
+        if (len < *min_len)
+                return false;
+
+        /* Check prefix length (in bits) vs address length (in bytes). */
+        if (cond->prefix_len > 8 * addr_len)
+                return false;
+
+        return true;
+}
+
+/* Validate a port comparison operator. */
+static inline bool valid_port_comparison(const struct inet_diag_bc_op *op,
+                                         int len, int *min_len)
+{
+        /* Port comparisons put the port in a follow-on inet_diag_bc_op. */
+        *min_len += sizeof(struct inet_diag_bc_op);
+        if (len < *min_len)
+                return false;
+        return true;
+}
+
 static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
 {
         const void *bc = bytecode;
@@ -516,29 +575,39 @@ static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
 
         while (len > 0) {
                 const struct inet_diag_bc_op *op = bc;
+                int min_len = sizeof(struct inet_diag_bc_op);
 
 //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
                 switch (op->code) {
-                case INET_DIAG_BC_AUTO:
                 case INET_DIAG_BC_S_COND:
                 case INET_DIAG_BC_D_COND:
+                        if (!valid_hostcond(bc, len, &min_len))
+                                return -EINVAL;
+                        break;
                 case INET_DIAG_BC_S_GE:
                 case INET_DIAG_BC_S_LE:
                 case INET_DIAG_BC_D_GE:
                 case INET_DIAG_BC_D_LE:
-                case INET_DIAG_BC_JMP:
-                        if (op->no < 4 || op->no > len + 4 || op->no & 3)
-                                return -EINVAL;
-                        if (op->no < len &&
-                            !valid_cc(bytecode, bytecode_len, len - op->no))
+                        if (!valid_port_comparison(bc, len, &min_len))
                                 return -EINVAL;
                         break;
+                case INET_DIAG_BC_AUTO:
+                case INET_DIAG_BC_JMP:
                 case INET_DIAG_BC_NOP:
                         break;
                 default:
                         return -EINVAL;
                 }
-                if (op->yes < 4 || op->yes > len + 4 || op->yes & 3)
+
+                if (op->code != INET_DIAG_BC_NOP) {
+                        if (op->no < min_len || op->no > len + 4 || op->no & 3)
+                                return -EINVAL;
+                        if (op->no < len &&
+                            !valid_cc(bytecode, bytecode_len, len - op->no))
+                                return -EINVAL;
+                }
+
+                if (op->yes < min_len || op->yes > len + 4 || op->yes & 3)
                         return -EINVAL;
                 bc  += op->yes;
                 len -= op->yes;
@@ -596,6 +665,36 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
                                    cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
 }
 
+/* Get the IPv4, IPv6, or IPv4-mapped-IPv6 local and remote addresses
+ * from a request_sock. For IPv4-mapped-IPv6 we must map IPv4 to IPv6.
+ */
+static inline void inet_diag_req_addrs(const struct sock *sk,
+                                       const struct request_sock *req,
+                                       struct inet_diag_entry *entry)
+{
+        struct inet_request_sock *ireq = inet_rsk(req);
+
+#if IS_ENABLED(CONFIG_IPV6)
+        if (sk->sk_family == AF_INET6) {
+                if (req->rsk_ops->family == AF_INET6) {
+                        entry->saddr = inet6_rsk(req)->loc_addr.s6_addr32;
+                        entry->daddr = inet6_rsk(req)->rmt_addr.s6_addr32;
+                } else if (req->rsk_ops->family == AF_INET) {
+                        ipv6_addr_set_v4mapped(ireq->loc_addr,
+                                               &entry->saddr_storage);
+                        ipv6_addr_set_v4mapped(ireq->rmt_addr,
+                                               &entry->daddr_storage);
+                        entry->saddr = entry->saddr_storage.s6_addr32;
+                        entry->daddr = entry->daddr_storage.s6_addr32;
+                }
+        } else
+#endif
+        {
+                entry->saddr = &ireq->loc_addr;
+                entry->daddr = &ireq->rmt_addr;
+        }
+}
+
 static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
                               struct request_sock *req,
                               struct user_namespace *user_ns,
@@ -637,8 +736,10 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
         r->idiag_inode = 0;
 #if IS_ENABLED(CONFIG_IPV6)
         if (r->idiag_family == AF_INET6) {
-                *(struct in6_addr *)r->id.idiag_src = inet6_rsk(req)->loc_addr;
-                *(struct in6_addr *)r->id.idiag_dst = inet6_rsk(req)->rmt_addr;
+                struct inet_diag_entry entry;
+                inet_diag_req_addrs(sk, req, &entry);
+                memcpy(r->id.idiag_src, entry.saddr, sizeof(struct in6_addr));
+                memcpy(r->id.idiag_dst, entry.daddr, sizeof(struct in6_addr));
         }
 #endif
 
@@ -691,18 +792,7 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
                                 continue;
 
                         if (bc) {
-                                entry.saddr =
-#if IS_ENABLED(CONFIG_IPV6)
-                                        (entry.family == AF_INET6) ?
-                                        inet6_rsk(req)->loc_addr.s6_addr32 :
-#endif
-                                        &ireq->loc_addr;
-                                entry.daddr =
-#if IS_ENABLED(CONFIG_IPV6)
-                                        (entry.family == AF_INET6) ?
-                                        inet6_rsk(req)->rmt_addr.s6_addr32 :
-#endif
-                                        &ireq->rmt_addr;
+                                inet_diag_req_addrs(sk, req, &entry);
                                 entry.dport = ntohs(ireq->rmt_port);
 
                                 if (!inet_diag_bc_run(bc, &entry))
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 448e68546827..8d5cc75dac88 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -707,28 +707,27 @@ EXPORT_SYMBOL(ip_defrag);
 
 struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
 {
-        const struct iphdr *iph;
+        struct iphdr iph;
         u32 len;
 
         if (skb->protocol != htons(ETH_P_IP))
                 return skb;
 
-        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+        if (!skb_copy_bits(skb, 0, &iph, sizeof(iph)))
                 return skb;
 
-        iph = ip_hdr(skb);
-        if (iph->ihl < 5 || iph->version != 4)
+        if (iph.ihl < 5 || iph.version != 4)
                 return skb;
-        if (!pskb_may_pull(skb, iph->ihl*4))
-                return skb;
-        iph = ip_hdr(skb);
-        len = ntohs(iph->tot_len);
-        if (skb->len < len || len < (iph->ihl * 4))
+
+        len = ntohs(iph.tot_len);
+        if (skb->len < len || len < (iph.ihl * 4))
                 return skb;
 
-        if (ip_is_fragment(ip_hdr(skb))) {
+        if (ip_is_fragment(&iph)) {
                 skb = skb_share_check(skb, GFP_ATOMIC);
                 if (skb) {
+                        if (!pskb_may_pull(skb, iph.ihl*4))
+                                return skb;
                         if (pskb_trim_rcsum(skb, len))
                                 return skb;
                         memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 6168c4dc58b1..3eab2b2ffd34 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1318,6 +1318,10 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
                 if (get_user(v, (u32 __user *)optval))
                         return -EFAULT;
 
+                /* "pimreg%u" should not exceed 16 bytes (IFNAMSIZ) */
+                if (v != RT_TABLE_DEFAULT && v >= 1000000000)
+                        return -EINVAL;
+
                 rtnl_lock();
                 ret = 0;
                 if (sk == rtnl_dereference(mrt->mroute_sk)) {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 083092e3aed6..e457c7ab2e28 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -830,8 +830,8 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags)
         return mss_now;
 }
 
-static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffset,
-                         size_t psize, int flags)
+static ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,
+                                size_t size, int flags)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int mss_now, size_goal;
@@ -858,12 +858,9 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffse
         if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
                 goto out_err;
 
-        while (psize > 0) {
+        while (size > 0) {
                 struct sk_buff *skb = tcp_write_queue_tail(sk);
-                struct page *page = pages[poffset / PAGE_SIZE];
                 int copy, i;
-                int offset = poffset % PAGE_SIZE;
-                int size = min_t(size_t, psize, PAGE_SIZE - offset);
                 bool can_coalesce;
 
                 if (!tcp_send_head(sk) || (copy = size_goal - skb->len) <= 0) {
@@ -912,8 +909,8 @@ new_segment:
                         TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_PSH;
 
                 copied += copy;
-                poffset += copy;
-                if (!(psize -= copy))
+                offset += copy;
+                if (!(size -= copy))
                         goto out;
 
                 if (skb->len < size_goal || (flags & MSG_OOB))
@@ -960,7 +957,7 @@ int tcp_sendpage(struct sock *sk, struct page *page, int offset,
                                         flags);
 
         lock_sock(sk);
-        res = do_tcp_sendpages(sk, &page, offset, size, flags);
+        res = do_tcp_sendpages(sk, page, offset, size, flags);
         release_sock(sk);
         return res;
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 609ff98aeb47..181fc8234a52 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5645,7 +5645,11 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
         tcp_fastopen_cache_set(sk, mss, cookie, syn_drop);
 
         if (data) { /* Retransmit unacked data in SYN */
-                tcp_retransmit_skb(sk, data);
+                tcp_for_write_queue_from(data, sk) {
+                        if (data == tcp_send_head(sk) ||
+                            __tcp_retransmit_skb(sk, data))
+                                break;
+                }
                 tcp_rearm_rto(sk);
                 return true;
         }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 2798706cb063..948ac275b9b5 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2309,12 +2309,11 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
  * state updates are done by the caller.  Returns non-zero if an
  * error occurred which prevented the send.
  */
-int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
         unsigned int cur_mss;
-        int err;
 
         /* Inconslusive MTU probe */
         if (icsk->icsk_mtup.probe_size) {
@@ -2387,11 +2386,17 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
         if (unlikely(NET_IP_ALIGN && ((unsigned long)skb->data & 3))) {
                 struct sk_buff *nskb = __pskb_copy(skb, MAX_TCP_HEADER,
                                                    GFP_ATOMIC);
-                err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
-                             -ENOBUFS;
+                return nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
+                              -ENOBUFS;
         } else {
-                err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
+                return tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
         }
+}
+
+int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int err = __tcp_retransmit_skb(sk, skb);
 
         if (err == 0) {
                 /* Update global TCP statistics. */
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index 1002e3396f72..ae43c62f9045 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -441,6 +441,7 @@ struct tsap_cb *irttp_open_tsap(__u8 stsap_sel, int credit, notify_t *notify)
         lsap = irlmp_open_lsap(stsap_sel, &ttp_notify, 0);
         if (lsap == NULL) {
                 IRDA_DEBUG(0, "%s: unable to allocate LSAP!!\n", __func__);
+                __irttp_close_tsap(self);
                 return NULL;
         }
 
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 83608ac16780..2c84185dfdb0 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -458,8 +458,6 @@ void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata)
                 list_move_tail(&roc->list, &tmp_list);
                 roc->abort = true;
         }
-
-        ieee80211_start_next_roc(local);
         mutex_unlock(&local->mtx);
 
         list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index b9a63381e349..45a101439bc5 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -793,7 +793,7 @@ static struct ip_set_type hash_netiface_type __read_mostly = {
                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
                 [IPSET_ATTR_IFACE]      = { .type = NLA_NUL_STRING,
-                                            .len = IPSET_MAXNAMELEN - 1 },
+                                            .len  = IFNAMSIZ - 1 },
                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 98c70630ad06..733cbf49ed1f 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -702,15 +702,11 @@ int ovs_flow_extract(struct sk_buff *skb, u16 in_port, struct sw_flow_key *key,
                         /* We only match on the lower 8 bits of the opcode. */
                         if (ntohs(arp->ar_op) <= 0xff)
                                 key->ip.proto = ntohs(arp->ar_op);
-
-                        if (key->ip.proto == ARPOP_REQUEST
-                                        || key->ip.proto == ARPOP_REPLY) {
-                                memcpy(&key->ipv4.addr.src, arp->ar_sip, sizeof(key->ipv4.addr.src));
-                                memcpy(&key->ipv4.addr.dst, arp->ar_tip, sizeof(key->ipv4.addr.dst));
-                                memcpy(key->ipv4.arp.sha, arp->ar_sha, ETH_ALEN);
-                                memcpy(key->ipv4.arp.tha, arp->ar_tha, ETH_ALEN);
-                                key_len = SW_FLOW_KEY_OFFSET(ipv4.arp);
-                        }
+                        memcpy(&key->ipv4.addr.src, arp->ar_sip, sizeof(key->ipv4.addr.src));
+                        memcpy(&key->ipv4.addr.dst, arp->ar_tip, sizeof(key->ipv4.addr.dst));
+                        memcpy(key->ipv4.arp.sha, arp->ar_sha, ETH_ALEN);
+                        memcpy(key->ipv4.arp.tha, arp->ar_tha, ETH_ALEN);
+                        key_len = SW_FLOW_KEY_OFFSET(ipv4.arp);
                 }
         } else if (key->eth.type == htons(ETH_P_IPV6)) {
                 int nh_len;             /* IPv6 Header + Extensions */
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index 3c1e58ba714b..a9033481fa5e 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -158,7 +158,7 @@ static int netdev_send(struct vport *vport, struct sk_buff *skb)
 
         if (unlikely(packet_length(skb) > mtu && !skb_is_gso(skb))) {
                 net_warn_ratelimited("%s: dropped over-mtu packet: %d > %d\n",
-                                     ovs_dp_name(vport->dp),
+                                     netdev_vport->dev->name,
                                      packet_length(skb), mtu);
                 goto error;
         }
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 7c2df9c33df3..69ce21e3716f 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -183,7 +183,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
 
         msg = sctp_datamsg_new(GFP_KERNEL);
         if (!msg)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         /* Note: Calculate this outside of the loop, so that all fragments
          * have the same expiration.
@@ -280,11 +280,14 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
 
                 chunk = sctp_make_datafrag_empty(asoc, sinfo, len, frag, 0);
 
-                if (!chunk)
+                if (!chunk) {
+                        err = -ENOMEM;
                         goto errout;
+                }
+
                 err = sctp_user_addto_chunk(chunk, offset, len, msgh->msg_iov);
                 if (err < 0)
-                        goto errout;
+                        goto errout_chunk_free;
 
                 offset += len;
 
@@ -315,8 +318,10 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
 
                 chunk = sctp_make_datafrag_empty(asoc, sinfo, over, frag, 0);
 
-                if (!chunk)
+                if (!chunk) {
+                        err = -ENOMEM;
                         goto errout;
+                }
 
                 err = sctp_user_addto_chunk(chunk, offset, over,msgh->msg_iov);
 
@@ -324,7 +329,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
                 __skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr
                            - (__u8 *)chunk->skb->data);
                 if (err < 0)
-                        goto errout;
+                        goto errout_chunk_free;
 
                 sctp_datamsg_assign(msg, chunk);
                 list_add_tail(&chunk->frag_list, &msg->chunks);
@@ -332,6 +337,9 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
 
         return msg;
 
+errout_chunk_free:
+        sctp_chunk_free(chunk);
+
 errout:
         list_for_each_safe(pos, temp, &msg->chunks) {
                 list_del_init(pos);
@@ -339,7 +347,7 @@ errout:
                 sctp_chunk_free(chunk);
         }
         sctp_datamsg_put(msg);
-        return NULL;
+        return ERR_PTR(err);
 }
 
 /* Check whether this message has expired. */
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index a60d1f8b41c5..406d957d08fb 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1915,8 +1915,8 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
 
         /* Break the message into multiple chunks of maximum size. */
         datamsg = sctp_datamsg_from_user(asoc, sinfo, msg, msg_len);
-        if (!datamsg) {
-                err = -ENOMEM;
+        if (IS_ERR(datamsg)) {
+                err = PTR_ERR(datamsg);
                 goto out_free;
         }
 
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 953c21e4af97..206cf5238fd3 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -331,7 +331,7 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
                  * 1/8, rto_alpha would be expressed as 3.
                  */
                 tp->rttvar = tp->rttvar - (tp->rttvar >> net->sctp.rto_beta)
-                        + ((abs(tp->srtt - rtt)) >> net->sctp.rto_beta);
+                        + (((__u32)abs64((__s64)tp->srtt - (__s64)rtt)) >> net->sctp.rto_beta);
                 tp->srtt = tp->srtt - (tp->srtt >> net->sctp.rto_alpha)
                         + (rtt >> net->sctp.rto_alpha);
         } else {