5 files changed, 38 insertions, 66 deletions

diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index c32ddf0279c8..b05b0557211f 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -261,7 +261,9 @@ enum { SCTP_ARBITRARY_COOKIE_ECHO_LEN = 200 };
  * must be less than 65535 (2^16 - 1), or we will have overflow
  * problems creating SACK's.
  */
-#define SCTP_TSN_MAP_SIZE 2048
+#define SCTP_TSN_MAP_INITIAL BITS_PER_LONG
+#define SCTP_TSN_MAP_INCREMENT SCTP_TSN_MAP_INITIAL
+#define SCTP_TSN_MAP_SIZE 4096
 #define SCTP_TSN_MAX_GAP  65535
 
 /* We will not record more than this many duplicate TSNs between two
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 17b932b8a55a..703305d00365 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -406,10 +406,7 @@ struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id);
 
 /* A macro to walk a list of skbs.  */
 #define sctp_skb_for_each(pos, head, tmp) \
-for (pos = (head)->next;\
-     tmp = (pos)->next, pos != ((struct sk_buff *)(head));\
-     pos = tmp)
-
+        skb_queue_walk_safe(head, pos, tmp)
 
 /* A helper to append an entire skb list (list) to another (head). */
 static inline void sctp_skb_list_tail(struct sk_buff_head *list,
@@ -420,10 +417,7 @@ static inline void sctp_skb_list_tail(struct sk_buff_head *list,
         sctp_spin_lock_irqsave(&head->lock, flags);
         sctp_spin_lock(&list->lock);
 
-        list_splice((struct list_head *)list, (struct list_head *)head->prev);
-
-        head->qlen += list->qlen;
-        list->qlen = 0;
+        skb_queue_splice_tail_init(list, head);
 
         sctp_spin_unlock(&list->lock);
         sctp_spin_unlock_irqrestore(&head->lock, flags);
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 24811732bdb2..029a54a02396 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -227,6 +227,9 @@ struct sctp_chunk *sctp_make_abort_violation(const struct sctp_association *,
                                    const struct sctp_chunk *,
                                    const __u8 *,
                                    const size_t );
+struct sctp_chunk *sctp_make_violation_paramlen(const struct sctp_association *,
+                                   const struct sctp_chunk *,
+                                   struct sctp_paramhdr *);
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *,
                                   const struct sctp_transport *,
                                   const void *payload,
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index ab1c472ea753..9661d7b765f0 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -731,20 +731,23 @@ struct sctp_chunk {
          */
         struct sk_buff *auth_chunk;
 
-        __u8 rtt_in_progress;   /* Is this chunk used for RTT calculation? */
-        __u8 resent;            /* Has this chunk ever been retransmitted. */
-        __u8 has_tsn;           /* Does this chunk have a TSN yet? */
-        __u8 has_ssn;           /* Does this chunk have a SSN yet? */
-        __u8 singleton;         /* Was this the only chunk in the packet? */
-        __u8 end_of_packet;     /* Was this the last chunk in the packet? */
-        __u8 ecn_ce_done;       /* Have we processed the ECN CE bit? */
-        __u8 pdiscard;          /* Discard the whole packet now? */
-        __u8 tsn_gap_acked;     /* Is this chunk acked by a GAP ACK? */
-        __s8 fast_retransmit;    /* Is this chunk fast retransmitted? */
-        __u8 tsn_missing_report; /* Data chunk missing counter. */
-        __u8 data_accepted;     /* At least 1 chunk in this packet accepted */
-        __u8 auth;              /* IN: was auth'ed | OUT: needs auth */
-        __u8 has_asconf;        /* IN: have seen an asconf before */
+#define SCTP_CAN_FRTX 0x0
+#define SCTP_NEED_FRTX 0x1
+#define SCTP_DONT_FRTX 0x2
+        __u16   rtt_in_progress:1,      /* This chunk used for RTT calc? */
+                resent:1,               /* Has this chunk ever been resent. */
+                has_tsn:1,              /* Does this chunk have a TSN yet? */
+                has_ssn:1,              /* Does this chunk have a SSN yet? */
+                singleton:1,            /* Only chunk in the packet? */
+                end_of_packet:1,        /* Last chunk in the packet? */
+                ecn_ce_done:1,          /* Have we processed the ECN CE bit? */
+                pdiscard:1,             /* Discard the whole packet now? */
+                tsn_gap_acked:1,        /* Is this chunk acked by a GAP ACK? */
+                data_accepted:1,        /* At least 1 chunk accepted */
+                auth:1,                 /* IN: was auth'ed | OUT: needs auth */
+                has_asconf:1,           /* IN: have seen an asconf before */
+                tsn_missing_report:2,   /* Data chunk missing counter. */
+                fast_retransmit:2;      /* Is this chunk fast retransmitted? */
 };
 
 void sctp_chunk_hold(struct sctp_chunk *);
@@ -1225,7 +1228,7 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw, int len,
 
 sctp_scope_t sctp_scope(const union sctp_addr *);
 int sctp_in_scope(const union sctp_addr *addr, const sctp_scope_t scope);
-int sctp_is_any(const union sctp_addr *addr);
+int sctp_is_any(struct sock *sk, const union sctp_addr *addr);
 int sctp_addr_is_valid(const union sctp_addr *addr);
 
 
@@ -1542,7 +1545,6 @@ struct sctp_association {
                  * in tsn_map--we get it by calling sctp_tsnmap_get_ctsn().
                  */
                 struct sctp_tsnmap tsn_map;
-                __u8 _map[sctp_tsnmap_storage_size(SCTP_TSN_MAP_SIZE)];
 
                 /* Ack State   : This flag indicates if the next received
                  *             : packet is to be responded to with a
diff --git a/include/net/sctp/tsnmap.h b/include/net/sctp/tsnmap.h
index 099211bf998d..4aabc5a96cf6 100644
--- a/include/net/sctp/tsnmap.h
+++ b/include/net/sctp/tsnmap.h
@@ -60,18 +60,7 @@ struct sctp_tsnmap {
          * It points at one of the two buffers with which we will
          * ping-pong between.
          */
-        __u8 *tsn_map;
-
-        /* This marks the tsn which overflows the tsn_map, when the
-         * cumulative ack point reaches this point we know we can switch
-         * maps (tsn_map and overflow_map swap).
-         */
-        __u32 overflow_tsn;
-
-        /* This is the overflow array for tsn_map.
-         * It points at one of the other ping-pong buffers.
-         */
-        __u8 *overflow_map;
+        unsigned long *tsn_map;
 
         /* This is the TSN at tsn_map[0].  */
         __u32 base_tsn;
@@ -89,15 +78,15 @@ struct sctp_tsnmap {
          */
         __u32 cumulative_tsn_ack_point;
 
+        /* This is the highest TSN we've marked.  */
+        __u32 max_tsn_seen;
+
         /* This is the minimum number of TSNs we can track.  This corresponds
          * to the size of tsn_map.   Note: the overflow_map allows us to
          * potentially track more than this quantity.
          */
         __u16 len;
 
-        /* This is the highest TSN we've marked.  */
-        __u32 max_tsn_seen;
-
         /* Data chunks pending receipt. used by SCTP_STATUS sockopt */
         __u16 pending_data;
 
@@ -105,29 +94,19 @@ struct sctp_tsnmap {
          * every SACK.  Store up to SCTP_MAX_DUP_TSNS worth of
          * information.
          */
-        __be32 dup_tsns[SCTP_MAX_DUP_TSNS];
         __u16 num_dup_tsns;
-
-        /* Record gap ack block information here.  */
-        struct sctp_gap_ack_block gabs[SCTP_MAX_GABS];
-
-        int malloced;
-
-        __u8 raw_map[0];
+        __be32 dup_tsns[SCTP_MAX_DUP_TSNS];
 };
 
 struct sctp_tsnmap_iter {
         __u32 start;
 };
 
-/* This macro assists in creation of external storage for variable length
- * internal buffers.  We double allocate so the overflow map works.
- */
-#define sctp_tsnmap_storage_size(count) (sizeof(__u8) * (count) * 2)
-
 /* Initialize a block of memory as a tsnmap.  */
 struct sctp_tsnmap *sctp_tsnmap_init(struct sctp_tsnmap *, __u16 len,
-                                     __u32 initial_tsn);
+                                     __u32 initial_tsn, gfp_t gfp);
+
+void sctp_tsnmap_free(struct sctp_tsnmap *map);
 
 /* Test the tracking state of this TSN.
  * Returns:
@@ -138,7 +117,7 @@ struct sctp_tsnmap *sctp_tsnmap_init(struct sctp_tsnmap *, __u16 len,
 int sctp_tsnmap_check(const struct sctp_tsnmap *, __u32 tsn);
 
 /* Mark this TSN as seen.  */
-void sctp_tsnmap_mark(struct sctp_tsnmap *, __u32 tsn);
+int sctp_tsnmap_mark(struct sctp_tsnmap *, __u32 tsn);
 
 /* Mark this TSN and all lower as seen. */
 void sctp_tsnmap_skip(struct sctp_tsnmap *map, __u32 tsn);
@@ -169,24 +148,16 @@ static inline __be32 *sctp_tsnmap_get_dups(struct sctp_tsnmap *map)
 }
 
 /* How many gap ack blocks do we have recorded? */
-__u16 sctp_tsnmap_num_gabs(struct sctp_tsnmap *map);
+__u16 sctp_tsnmap_num_gabs(struct sctp_tsnmap *map,
+                           struct sctp_gap_ack_block *gabs);
 
 /* Refresh the count on pending data. */
 __u16 sctp_tsnmap_pending(struct sctp_tsnmap *map);
 
-/* Return pointer to gap ack blocks as needed by SACK. */
-static inline struct sctp_gap_ack_block *sctp_tsnmap_get_gabs(struct sctp_tsnmap *map)
-{
-        return map->gabs;
-}
-
 /* Is there a gap in the TSN map?  */
 static inline int sctp_tsnmap_has_gap(const struct sctp_tsnmap *map)
 {
-        int has_gap;
-
-        has_gap = (map->cumulative_tsn_ack_point != map->max_tsn_seen);
-        return has_gap;
+        return (map->cumulative_tsn_ack_point != map->max_tsn_seen);
 }
 
 /* Mark a duplicate TSN.  Note:  limit the storage of duplicate TSN