1 files changed, 43 insertions, 17 deletions

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 67fdac9d2d33..fbb70770ad05 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -67,6 +67,7 @@
 #include <linux/poll.h>
 #include <linux/init.h>
 #include <linux/crypto.h>
+#include <linux/slab.h>
 
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -915,6 +916,11 @@ SCTP_STATIC int sctp_setsockopt_bindx(struct sock* sk,
         /* Walk through the addrs buffer and count the number of addresses. */
         addr_buf = kaddrs;
         while (walk_size < addrs_size) {
+                if (walk_size + sizeof(sa_family_t) > addrs_size) {
+                        kfree(kaddrs);
+                        return -EINVAL;
+                }
+
                 sa_addr = (struct sockaddr *)addr_buf;
                 af = sctp_get_af_specific(sa_addr->sa_family);
 
@@ -1001,9 +1007,13 @@ static int __sctp_connect(struct sock* sk,
         /* Walk through the addrs buffer and count the number of addresses. */
         addr_buf = kaddrs;
         while (walk_size < addrs_size) {
+                if (walk_size + sizeof(sa_family_t) > addrs_size) {
+                        err = -EINVAL;
+                        goto out_free;
+                }
+
                 sa_addr = (union sctp_addr *)addr_buf;
                 af = sctp_get_af_specific(sa_addr->sa.sa_family);
-                port = ntohs(sa_addr->v4.sin_port);
 
                 /* If the address family is not supported or if this address
                  * causes the address buffer to overflow return EINVAL.
@@ -1013,6 +1023,8 @@ static int __sctp_connect(struct sock* sk,
                         goto out_free;
                 }
 
+                port = ntohs(sa_addr->v4.sin_port);
+
                 /* Save current address so we can work with it */
                 memcpy(&to, sa_addr, af->sockaddr_len);
 
@@ -3718,9 +3730,9 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
         sp->hmac = NULL;
 
         SCTP_DBG_OBJCNT_INC(sock);
-        percpu_counter_inc(&sctp_sockets_allocated);
 
         local_bh_disable();
+        percpu_counter_inc(&sctp_sockets_allocated);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         local_bh_enable();
 
@@ -3737,8 +3749,8 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
         /* Release our hold on the endpoint. */
         ep = sctp_sk(sk)->ep;
         sctp_endpoint_free(ep);
-        percpu_counter_dec(&sctp_sockets_allocated);
         local_bh_disable();
+        percpu_counter_dec(&sctp_sockets_allocated);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
         local_bh_enable();
 }
@@ -4383,7 +4395,7 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
                                 transports) {
                 memcpy(&temp, &from->ipaddr, sizeof(temp));
                 sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp, &temp);
-                addrlen = sctp_get_af_specific(sk->sk_family)->sockaddr_len;
+                addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
                 if (space_left < addrlen)
                         return -ENOMEM;
                 if (copy_to_user(to, &temp, addrlen))
@@ -5432,6 +5444,8 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
                         rover++;
                         if ((rover < low) || (rover > high))
                                 rover = low;
+                        if (inet_is_reserved_local_port(rover))
+                                continue;
                         index = sctp_phashfn(rover);
                         head = &sctp_port_hashtable[index];
                         sctp_spin_lock(&head->lock);
@@ -5478,7 +5492,6 @@ pp_found:
                  */
                 int reuse = sk->sk_reuse;
                 struct sock *sk2;
-                struct hlist_node *node;
 
                 SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
                 if (pp->fastreuse && sk->sk_reuse &&
@@ -5699,7 +5712,7 @@ unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
         struct sctp_sock *sp = sctp_sk(sk);
         unsigned int mask;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        poll_wait(file, sk_sleep(sk), wait);
 
         /* A TCP-style listening socket becomes readable when the accept queue
          * is not empty.
@@ -5940,7 +5953,7 @@ static int sctp_wait_for_packet(struct sock * sk, int *err, long *timeo_p)
         int error;
         DEFINE_WAIT(wait);
 
-        prepare_to_wait_exclusive(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait_exclusive(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
         /* Socket errors? */
         error = sock_error(sk);
@@ -5977,14 +5990,14 @@ static int sctp_wait_for_packet(struct sock * sk, int *err, long *timeo_p)
         sctp_lock_sock(sk);
 
 ready:
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return 0;
 
 interrupted:
         error = sock_intr_errno(*timeo_p);
 
 out:
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         *err = error;
         return error;
 }
@@ -6058,14 +6071,14 @@ static void __sctp_write_space(struct sctp_association *asoc)
                         wake_up_interruptible(&asoc->wait);
 
                 if (sctp_writeable(sk)) {
-                        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-                                wake_up_interruptible(sk->sk_sleep);
+                        if (sk_sleep(sk) && waitqueue_active(sk_sleep(sk)))
+                                wake_up_interruptible(sk_sleep(sk));
 
                         /* Note that we try to include the Async I/O support
                          * here by modeling from the current TCP/UDP code.
                          * We have not tested with it yet.
                          */
-                        if (sock->fasync_list &&
+                        if (sock->wq->fasync_list &&
                             !(sk->sk_shutdown & SEND_SHUTDOWN))
                                 sock_wake_async(sock,
                                                 SOCK_WAKE_SPACE, POLL_OUT);
@@ -6185,6 +6198,19 @@ do_nonblock:
         goto out;
 }
 
+void sctp_data_ready(struct sock *sk, int len)
+{
+        struct socket_wq *wq;
+
+        rcu_read_lock();
+        wq = rcu_dereference(sk->sk_wq);
+        if (wq_has_sleeper(wq))
+                wake_up_interruptible_sync_poll(&wq->wait, POLLIN |
+                                                POLLRDNORM | POLLRDBAND);
+        sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
+        rcu_read_unlock();
+}
+
 /* If socket sndbuf has changed, wake up all per association waiters.  */
 void sctp_write_space(struct sock *sk)
 {
@@ -6293,7 +6319,7 @@ static int sctp_wait_for_accept(struct sock *sk, long timeo)
 
 
         for (;;) {
-                prepare_to_wait_exclusive(sk->sk_sleep, &wait,
+                prepare_to_wait_exclusive(sk_sleep(sk), &wait,
                                           TASK_INTERRUPTIBLE);
 
                 if (list_empty(&ep->asocs)) {
@@ -6319,7 +6345,7 @@ static int sctp_wait_for_accept(struct sock *sk, long timeo)
                         break;
         }
 
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
 
         return err;
 }
@@ -6329,7 +6355,7 @@ static void sctp_wait_for_close(struct sock *sk, long timeout)
         DEFINE_WAIT(wait);
 
         do {
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 if (list_empty(&sctp_sk(sk)->ep->asocs))
                         break;
                 sctp_release_sock(sk);
@@ -6337,7 +6363,7 @@ static void sctp_wait_for_close(struct sock *sk, long timeout)
                 sctp_lock_sock(sk);
         } while (!signal_pending(current) && timeout);
 
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
 }
 
 static void sctp_skb_set_owner_r_frag(struct sk_buff *skb, struct sock *sk)
@@ -6359,7 +6385,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
                     struct sctp_association *asoc)
 {
         struct inet_sock *inet = inet_sk(sk);
-        struct inet_sock *newinet = inet_sk(newsk);
+        struct inet_sock *newinet;
 
         newsk->sk_type = sk->sk_type;
         newsk->sk_bound_dev_if = sk->sk_bound_dev_if;