2 files changed, 23 insertions, 16 deletions

diff --git a/net/dccp/ackvec.c b/net/dccp/ackvec.c
index a979f4e5041d..ce9cb77c5c29 100644
--- a/net/dccp/ackvec.c
+++ b/net/dccp/ackvec.c
@@ -55,8 +55,8 @@ int dccp_insert_option_ackvec(struct sock *sk, struct sk_buff *skb)
         from = av->dccpav_buf + av->dccpav_buf_head;
 
         /* Check if buf_head wraps */
-        if (av->dccpav_buf_head + len > av->dccpav_vec_len) {
-                const u32 tailsize = (av->dccpav_vec_len - av->dccpav_buf_head);
+        if ((int)av->dccpav_buf_head + len > av->dccpav_vec_len) {
+                const u32 tailsize = av->dccpav_vec_len - av->dccpav_buf_head;
 
                 memcpy(to, from, tailsize);
                 to   += tailsize;
@@ -93,8 +93,14 @@ int dccp_insert_option_ackvec(struct sock *sk, struct sk_buff *skb)
 struct dccp_ackvec *dccp_ackvec_alloc(const unsigned int len,
                                       const gfp_t priority)
 {
-        struct dccp_ackvec *av = kmalloc(sizeof(*av) + len, priority);
+        struct dccp_ackvec *av;
 
+        BUG_ON(len == 0);
+
+        if (len > DCCP_MAX_ACKVEC_LEN)
+                return NULL;
+
+        av = kmalloc(sizeof(*av) + len, priority);
         if (av != NULL) {
                 av->dccpav_buf_len      = len;
                 av->dccpav_buf_head     =
@@ -117,13 +123,13 @@ void dccp_ackvec_free(struct dccp_ackvec *av)
 }
 
 static inline u8 dccp_ackvec_state(const struct dccp_ackvec *av,
-                                   const unsigned int index)
+                                   const u8 index)
 {
         return av->dccpav_buf[index] & DCCP_ACKVEC_STATE_MASK;
 }
 
 static inline u8 dccp_ackvec_len(const struct dccp_ackvec *av,
-                                 const unsigned int index)
+                                 const u8 index)
 {
         return av->dccpav_buf[index] & DCCP_ACKVEC_LEN_MASK;
 }
@@ -135,7 +141,7 @@ static inline u8 dccp_ackvec_len(const struct dccp_ackvec *av,
  */
 static inline int dccp_ackvec_set_buf_head_state(struct dccp_ackvec *av,
                                                  const unsigned int packets,
-                                                  const unsigned char state)
+                                                 const unsigned char state)
 {
         unsigned int gap;
         signed long new_head;
@@ -223,7 +229,7 @@ int dccp_ackvec_add(struct dccp_ackvec *av, const struct sock *sk,
                  *      could reduce the complexity of this scan.)
                  */
                 u64 delta = dccp_delta_seqno(ackno, av->dccpav_buf_ackno);
-                unsigned int index = av->dccpav_buf_head;
+                u8 index = av->dccpav_buf_head;
 
                 while (1) {
                         const u8 len = dccp_ackvec_len(av, index);
@@ -301,9 +307,10 @@ static void dccp_ackvec_throw_away_ack_record(struct dccp_ackvec *av)
          * draft-ietf-dccp-spec-11.txt Appendix A. -acme
          */
 #if 0
-        av->dccpav_buf_tail = av->dccpav_ack_ptr + 1;
-        if (av->dccpav_buf_tail >= av->dccpav_vec_len)
-                av->dccpav_buf_tail -= av->dccpav_vec_len;
+        u32 new_buf_tail = av->dccpav_ack_ptr + 1;
+        if (new_buf_tail >= av->dccpav_vec_len)
+                new_buf_tail -= av->dccpav_vec_len;
+        av->dccpav_buf_tail = new_buf_tail;
 #endif
         av->dccpav_vec_len -= av->dccpav_sent_len;
 }
diff --git a/net/dccp/ackvec.h b/net/dccp/ackvec.h
index d0fd6c60c574..f7dfb5f67b87 100644
--- a/net/dccp/ackvec.h
+++ b/net/dccp/ackvec.h
@@ -54,16 +54,16 @@
  * @dccpav_buf - circular buffer of acknowledgeable packets
  */
 struct dccp_ackvec {
-        unsigned int    dccpav_buf_head;
-        unsigned int    dccpav_buf_tail;
         u64             dccpav_buf_ackno;
         u64             dccpav_ack_seqno;
         u64             dccpav_ack_ackno;
-        unsigned int    dccpav_ack_ptr;
-        unsigned int    dccpav_sent_len;
-        unsigned int    dccpav_vec_len;
-        unsigned int    dccpav_buf_len;
         struct timeval  dccpav_time;
+        u8              dccpav_buf_head;
+        u8              dccpav_buf_tail;
+        u8              dccpav_ack_ptr;
+        u8              dccpav_sent_len;
+        u8              dccpav_vec_len;
+        u8              dccpav_buf_len;
         u8              dccpav_buf_nonce;
         u8              dccpav_ack_nonce;
         u8              dccpav_buf[0];