1 files changed, 26 insertions, 11 deletions

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index d4df45022ffa..24b2cd555637 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -56,6 +56,7 @@
 #include <linux/ipv6.h>
 #include <linux/net.h>
 #include <linux/inet.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/inet_ecn.h>
 #include <linux/skbuff.h>
@@ -996,14 +997,15 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
                                 sctp_sf_heartbeat(ep, asoc, type, arg,
                                                   commands))
                         return SCTP_DISPOSITION_NOMEM;
+
                 /* Set transport error counter and association error counter
                  * when sending heartbeat.
                  */
-                sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
-                                SCTP_TRANSPORT(transport));
                 sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_HB_SENT,
                                 SCTP_TRANSPORT(transport));
         }
+        sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_IDLE,
+                        SCTP_TRANSPORT(transport));
         sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMER_UPDATE,
                         SCTP_TRANSPORT(transport));
 
@@ -1720,7 +1722,7 @@ static sctp_disposition_t sctp_sf_do_dupcook_a(const struct sctp_endpoint *ep,
 
                 err = sctp_make_op_error(asoc, chunk,
                                          SCTP_ERROR_COOKIE_IN_SHUTDOWN,
-                                         NULL, 0);
+                                         NULL, 0, 0);
                 if (err)
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err));
@@ -2868,6 +2870,7 @@ sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
                                         sctp_cmd_seq_t *commands)
 {
         struct sctp_chunk *chunk = arg;
+        sctp_arg_t force = SCTP_NOFORCE();
         int error;
 
         if (!sctp_vtag_verify(chunk, asoc)) {
@@ -2901,6 +2904,9 @@ sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
                 BUG();
         }
 
+        if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
+                force = SCTP_FORCE();
+
         if (asoc->autoclose) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
@@ -2929,7 +2935,7 @@ sctp_disposition_t sctp_sf_eat_data_6_2(const struct sctp_endpoint *ep,
          * more aggressive than the following algorithms allow.
          */
         if (chunk->end_of_packet)
-                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
+                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
 
         return SCTP_DISPOSITION_CONSUME;
 
@@ -2954,7 +2960,7 @@ discard_force:
 
 discard_noforce:
         if (chunk->end_of_packet)
-                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, SCTP_NOFORCE());
+                sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
 
         return SCTP_DISPOSITION_DISCARD;
 consume:
@@ -3572,7 +3578,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
          * To do this properly, we'll set the destination address of the chunk
          * and at the transmit time, will try look up the transport to use.
          * Since ASCONFs may be bundled, the correct transport may not be
-         * created untill we process the entire packet, thus this workaround.
+         * created until we process the entire packet, thus this workaround.
          */
         asconf_ack->dest = chunk->source;
         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
@@ -3670,8 +3676,14 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
 
                 if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
-                                             asconf_ack))
+                                             asconf_ack)) {
+                        /* Successfully processed ASCONF_ACK.  We can
+                         * release the next asconf if we have one.
+                         */
+                        sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
+                                        SCTP_NULL());
                         return SCTP_DISPOSITION_CONSUME;
+                }
 
                 abort = sctp_make_abort(asoc, asconf_ack,
                                         sizeof(sctp_errhdr_t));
@@ -3973,7 +3985,7 @@ sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
                         err_chunk = sctp_make_op_error(asoc, chunk,
                                                         SCTP_ERROR_UNSUP_HMAC,
                                                         &auth_hdr->hmac_id,
-                                                        sizeof(__u16));
+                                                        sizeof(__u16), 0);
                         if (err_chunk) {
                                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                                 SCTP_CHUNK(err_chunk));
@@ -4065,7 +4077,8 @@ sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
                 hdr = unk_chunk->chunk_hdr;
                 err_chunk = sctp_make_op_error(asoc, unk_chunk,
                                                SCTP_ERROR_UNKNOWN_CHUNK, hdr,
-                                               WORD_ROUND(ntohs(hdr->length)));
+                                               WORD_ROUND(ntohs(hdr->length)),
+                                               0);
                 if (err_chunk) {
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err_chunk));
@@ -4084,7 +4097,8 @@ sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
                 hdr = unk_chunk->chunk_hdr;
                 err_chunk = sctp_make_op_error(asoc, unk_chunk,
                                                SCTP_ERROR_UNKNOWN_CHUNK, hdr,
-                                               WORD_ROUND(ntohs(hdr->length)));
+                                               WORD_ROUND(ntohs(hdr->length)),
+                                               0);
                 if (err_chunk) {
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err_chunk));
@@ -6048,7 +6062,8 @@ static int sctp_eat_data(const struct sctp_association *asoc,
 
                 err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
                                          &data_hdr->stream,
-                                         sizeof(data_hdr->stream));
+                                         sizeof(data_hdr->stream),
+                                         sizeof(u16));
                 if (err)
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err));