7 files changed, 21 insertions, 12 deletions

diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 8e9580874216..9a430734530c 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -783,7 +783,7 @@ static struct ccid_operations ccid2 = {
 };
 
 #ifdef CONFIG_IP_DCCP_CCID2_DEBUG
-module_param(ccid2_debug, bool, 0444);
+module_param(ccid2_debug, bool, 0644);
 MODULE_PARM_DESC(ccid2_debug, "Enable debug messages");
 #endif
 
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index f6756e0c9e69..3b8bd7ca6761 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -963,7 +963,7 @@ static struct ccid_operations ccid3 = {
 };
 
 #ifdef CONFIG_IP_DCCP_CCID3_DEBUG
-module_param(ccid3_debug, bool, 0444);
+module_param(ccid3_debug, bool, 0644);
 MODULE_PARM_DESC(ccid3_debug, "Enable debug messages");
 #endif
 
diff --git a/net/dccp/ccids/lib/loss_interval.c b/net/dccp/ccids/lib/loss_interval.c
index bcd6ac415bb9..5b3ce0688c5c 100644
--- a/net/dccp/ccids/lib/loss_interval.c
+++ b/net/dccp/ccids/lib/loss_interval.c
@@ -67,7 +67,10 @@ static void tfrc_lh_calc_i_mean(struct tfrc_loss_hist *lh)
         u32 i_i, i_tot0 = 0, i_tot1 = 0, w_tot = 0;
         int i, k = tfrc_lh_length(lh) - 1; /* k is as in rfc3448bis, 5.4 */
 
-        for (i=0; i <= k; i++) {
+        if (k <= 0)
+                return;
+
+        for (i = 0; i <= k; i++) {
                 i_i = tfrc_lh_get_interval(lh, i);
 
                 if (i < k) {
@@ -78,7 +81,6 @@ static void tfrc_lh_calc_i_mean(struct tfrc_loss_hist *lh)
                         i_tot1 += i_i * tfrc_lh_weights[i-1];
         }
 
-        BUG_ON(w_tot == 0);
         lh->i_mean = max(i_tot0, i_tot1) / w_tot;
 }
 
diff --git a/net/dccp/ccids/lib/tfrc.c b/net/dccp/ccids/lib/tfrc.c
index 97ecec0a8e76..185916218e07 100644
--- a/net/dccp/ccids/lib/tfrc.c
+++ b/net/dccp/ccids/lib/tfrc.c
@@ -10,7 +10,7 @@
 
 #ifdef CONFIG_IP_DCCP_TFRC_DEBUG
 int tfrc_debug;
-module_param(tfrc_debug, bool, 0444);
+module_param(tfrc_debug, bool, 0644);
 MODULE_PARM_DESC(tfrc_debug, "Enable debug messages");
 #endif
 
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 803933ab396d..779d0ed9ae94 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -370,7 +370,7 @@ int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
                 goto discard;
 
         if (dccp_parse_options(sk, NULL, skb))
-                goto discard;
+                return 1;
 
         if (DCCP_SKB_CB(skb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
                 dccp_event_ack_recv(sk, skb);
@@ -610,7 +610,7 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                  * Step 8: Process options and mark acknowledgeable
                  */
                 if (dccp_parse_options(sk, NULL, skb))
-                        goto discard;
+                        return 1;
 
                 if (dcb->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
                         dccp_event_ack_recv(sk, skb);
diff --git a/net/dccp/options.c b/net/dccp/options.c
index dc7c158a2f4b..0809b63cb055 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -81,11 +81,11 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
                 /* Check if this isn't a single byte option */
                 if (opt > DCCPO_MAX_RESERVED) {
                         if (opt_ptr == opt_end)
-                                goto out_invalid_option;
+                                goto out_nonsensical_length;
 
                         len = *opt_ptr++;
-                        if (len < 3)
-                                goto out_invalid_option;
+                        if (len < 2)
+                                goto out_nonsensical_length;
                         /*
                          * Remove the type and len fields, leaving
                          * just the value size
@@ -95,7 +95,7 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
                         opt_ptr += len;
 
                         if (opt_ptr > opt_end)
-                                goto out_invalid_option;
+                                goto out_nonsensical_length;
                 }
 
                 /*
@@ -283,12 +283,17 @@ ignore_option:
         if (mandatory)
                 goto out_invalid_option;
 
+out_nonsensical_length:
+        /* RFC 4340, 5.8: ignore option and all remaining option space */
         return 0;
 
 out_invalid_option:
         DCCP_INC_STATS_BH(DCCP_MIB_INVALIDOPT);
         DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_OPTION_ERROR;
         DCCP_WARN("DCCP(%p): invalid option %d, len=%d", sk, opt, len);
+        DCCP_SKB_CB(skb)->dccpd_reset_data[0] = opt;
+        DCCP_SKB_CB(skb)->dccpd_reset_data[1] = len > 0 ? value[0] : 0;
+        DCCP_SKB_CB(skb)->dccpd_reset_data[2] = len > 1 ? value[1] : 0;
         return -1;
 }
 
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 1ca3b26eed0f..d0bd34819761 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -309,7 +309,9 @@ int dccp_disconnect(struct sock *sk, int flags)
                 sk->sk_err = ECONNRESET;
 
         dccp_clear_xmit_timers(sk);
+
         __skb_queue_purge(&sk->sk_receive_queue);
+        __skb_queue_purge(&sk->sk_write_queue);
         if (sk->sk_send_head != NULL) {
                 __kfree_skb(sk->sk_send_head);
                 sk->sk_send_head = NULL;
@@ -1028,7 +1030,7 @@ MODULE_PARM_DESC(thash_entries, "Number of ehash buckets");
 
 #ifdef CONFIG_IP_DCCP_DEBUG
 int dccp_debug;
-module_param(dccp_debug, bool, 0444);
+module_param(dccp_debug, bool, 0644);
 MODULE_PARM_DESC(dccp_debug, "Enable debug messages");
 
 EXPORT_SYMBOL_GPL(dccp_debug);