1 files changed, 22 insertions, 22 deletions

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index a26065be7289..01e002430c85 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -22,9 +22,8 @@
  * See the GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
- * the Free Software Foundation, 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.
+ * along with GNU CC; see the file COPYING.  If not, see
+ * <http://www.gnu.org/licenses/>.
  *
  * Please send any bug reports or fixes you make to the
  * email address(es):
@@ -759,6 +758,12 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
                 struct sctp_chunk auth;
                 sctp_ierror_t ret;
 
+                /* Make sure that we and the peer are AUTH capable */
+                if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
+                        sctp_association_free(new_asoc);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+                }
+
                 /* set-up our fake chunk so that we can process it */
                 auth.skb = chunk->auth_chunk;
                 auth.asoc = chunk->asoc;
@@ -769,10 +774,6 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
                 auth.transport = chunk->transport;
 
                 ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
-
-                /* We can now safely free the auth_chunk clone */
-                kfree_skb(chunk->auth_chunk);
-
                 if (ret != SCTP_IERROR_NO_ERROR) {
                         sctp_association_free(new_asoc);
                         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
@@ -2946,7 +2947,7 @@ sctp_disposition_t sctp_sf_eat_data_6_2(struct net *net,
                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
-        error = sctp_eat_data(asoc, chunk, commands );
+        error = sctp_eat_data(asoc, chunk, commands);
         switch (error) {
         case SCTP_IERROR_NO_ERROR:
                 break;
@@ -3067,7 +3068,7 @@ sctp_disposition_t sctp_sf_eat_data_fast_4_4(struct net *net,
                 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                   commands);
 
-        error = sctp_eat_data(asoc, chunk, commands );
+        error = sctp_eat_data(asoc, chunk, commands);
         switch (error) {
         case SCTP_IERROR_NO_ERROR:
         case SCTP_IERROR_HIGH_TSN:
@@ -3682,8 +3683,7 @@ sctp_disposition_t sctp_sf_do_asconf(struct net *net,
         asconf_ack->dest = chunk->source;
         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
         if (asoc->new_transport) {
-                sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport,
-                    commands);
+                sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport, commands);
                 ((struct sctp_association *)asoc)->new_transport = NULL;
         }
 
@@ -3766,7 +3766,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(struct net *net,
                  */
                 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
-                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
                 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
                                 SCTP_ERROR(ECONNABORTED));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
@@ -3800,7 +3800,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(struct net *net,
                 /* We are going to ABORT, so we might as well stop
                  * processing the rest of the chunks in the packet.
                  */
-                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
                 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
                                 SCTP_ERROR(ECONNABORTED));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
@@ -4452,7 +4452,7 @@ static sctp_disposition_t sctp_sf_violation_chunklen(
                                      void *arg,
                                      sctp_cmd_seq_t *commands)
 {
-        static const char err_str[]="The following chunk had invalid length:";
+        static const char err_str[] = "The following chunk had invalid length:";
 
         return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
                                         sizeof(err_str));
@@ -4515,7 +4515,7 @@ static sctp_disposition_t sctp_sf_violation_ctsn(
                                      void *arg,
                                      sctp_cmd_seq_t *commands)
 {
-        static const char err_str[]="The cumulative tsn ack beyond the max tsn currently sent:";
+        static const char err_str[] = "The cumulative tsn ack beyond the max tsn currently sent:";
 
         return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
                                         sizeof(err_str));
@@ -4535,7 +4535,7 @@ static sctp_disposition_t sctp_sf_violation_chunk(
                                      void *arg,
                                      sctp_cmd_seq_t *commands)
 {
-        static const char err_str[]="The following chunk violates protocol:";
+        static const char err_str[] = "The following chunk violates protocol:";
 
         if (!asoc)
                 return sctp_sf_violation(net, ep, asoc, type, arg, commands);
@@ -4611,7 +4611,7 @@ sctp_disposition_t sctp_sf_do_prm_asoc(struct net *net,
                                        sctp_cmd_seq_t *commands)
 {
         struct sctp_chunk *repl;
-        struct sctp_association* my_asoc;
+        struct sctp_association *my_asoc;
 
         /* The comment below says that we enter COOKIE-WAIT AFTER
          * sending the INIT, but that doesn't actually work in our
@@ -6001,7 +6001,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
                 /* Special case the INIT-ACK as there is no peer's vtag
                  * yet.
                  */
-                switch(chunk->chunk_hdr->type) {
+                switch (chunk->chunk_hdr->type) {
                 case SCTP_CID_INIT_ACK:
                 {
                         sctp_initack_chunk_t *initack;
@@ -6018,7 +6018,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
                 /* Special case the INIT and stale COOKIE_ECHO as there is no
                  * vtag yet.
                  */
-                switch(chunk->chunk_hdr->type) {
+                switch (chunk->chunk_hdr->type) {
                 case SCTP_CID_INIT:
                 {
                         sctp_init_chunk_t *init;
@@ -6178,7 +6178,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          * PMTU.  In cases, such as loopback, this might be a rather
          * large spill over.
          */
-        if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
+        if ((!chunk->data_accepted) && (!asoc->rwnd ||
             (datalen > asoc->rwnd + asoc->frag_point))) {
 
                 /* If this is the next TSN, consider reneging to make
@@ -6208,7 +6208,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          */
         if (*sk->sk_prot_creator->memory_pressure) {
                 if (sctp_tsnmap_has_gap(map) &&
-                   (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
+                    (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
                         pr_debug("%s: under pressure, reneging for tsn:%u\n",
                                  __func__, tsn);
                         deliver = SCTP_CMD_RENEGE;
@@ -6232,7 +6232,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
                 /* We are going to ABORT, so we might as well stop
                  * processing the rest of the chunks in the packet.
                  */
-                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
                 sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
                                 SCTP_ERROR(ECONNABORTED));
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,