1 files changed, 32 insertions, 1 deletions

diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 1c88c8911dc5..a6d27bf563a5 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -754,6 +754,16 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
          */
 
         list_for_each_entry_safe(chunk, tmp, &q->control_chunk_list, list) {
+                /* RFC 5061, 5.3
+                 * F1) This means that until such time as the ASCONF
+                 * containing the add is acknowledged, the sender MUST
+                 * NOT use the new IP address as a source for ANY SCTP
+                 * packet except on carrying an ASCONF Chunk.
+                 */
+                if (asoc->src_out_of_asoc_ok &&
+                    chunk->chunk_hdr->type != SCTP_CID_ASCONF)
+                        continue;
+
                 list_del_init(&chunk->list);
 
                 /* Pick the right transport to use. */
@@ -881,6 +891,9 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                 }
         }
 
+        if (q->asoc->src_out_of_asoc_ok)
+                goto sctp_flush_out;
+
         /* Is it OK to send data chunks?  */
         switch (asoc->state) {
         case SCTP_STATE_COOKIE_ECHOED:
@@ -1582,6 +1595,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
 #endif /* SCTP_DEBUG */
         if (transport) {
                 if (bytes_acked) {
+                        struct sctp_association *asoc = transport->asoc;
+
                         /* We may have counted DATA that was migrated
                          * to this transport due to DEL-IP operation.
                          * Subtract those bytes, since the were never
@@ -1600,6 +1615,17 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                         transport->error_count = 0;
                         transport->asoc->overall_error_count = 0;
 
+                        /*
+                         * While in SHUTDOWN PENDING, we may have started
+                         * the T5 shutdown guard timer after reaching the
+                         * retransmission limit. Stop that timer as soon
+                         * as the receiver acknowledged any data.
+                         */
+                        if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING &&
+                            del_timer(&asoc->timers
+                                [SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD]))
+                                        sctp_association_put(asoc);
+
                         /* Mark the destination transport address as
                          * active if it is not so marked.
                          */
@@ -1629,10 +1655,15 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                          * A sender is doing zero window probing when the
                          * receiver's advertised window is zero, and there is
                          * only one data chunk in flight to the receiver.
+                         *
+                         * Allow the association to timeout while in SHUTDOWN
+                         * PENDING or SHUTDOWN RECEIVED in case the receiver
+                         * stays in zero window mode forever.
                          */
                         if (!q->asoc->peer.rwnd &&
                             !list_empty(&tlist) &&
-                            (sack_ctsn+2 == q->asoc->next_tsn)) {
+                            (sack_ctsn+2 == q->asoc->next_tsn) &&
+                            q->asoc->state < SCTP_STATE_SHUTDOWN_PENDING) {
                                 SCTP_DEBUG_PRINTK("%s: SACK received for zero "
                                                   "window probe: %u\n",
                                                   __func__, sack_ctsn);