9 files changed, 78 insertions, 27 deletions

diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 27329ce9c311..ed0445fe85e7 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -346,11 +346,18 @@ void sctp_association_free(struct sctp_association *asoc)
         struct list_head *pos, *temp;
         int i;
 
-        list_del(&asoc->asocs);
+        /* Only real associations count against the endpoint, so
+         * don't bother for if this is a temporary association.
+         */
+        if (!asoc->temp) {
+                list_del(&asoc->asocs);
 
-        /* Decrement the backlog value for a TCP-style listening socket. */
-        if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
-                sk->sk_ack_backlog--;
+                /* Decrement the backlog value for a TCP-style listening
+                 * socket.
+                 */
+                if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
+                        sk->sk_ack_backlog--;
+        }
 
         /* Mark as dead, so other users can know this structure is
          * going away.
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 35c49ff2d062..9b6b394b66f6 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -144,6 +144,13 @@ void sctp_endpoint_add_asoc(struct sctp_endpoint *ep,
 {
         struct sock *sk = ep->base.sk;
 
+        /* If this is a temporary association, don't bother
+         * since we'll be removing it shortly and don't
+         * want anyone to find it anyway.
+         */
+        if (asoc->temp)
+                return;
+
         /* Now just add it to our list of asocs */
         list_add_tail(&asoc->asocs, &ep->asocs);
 
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 64f630102532..6d82f400d13c 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -135,6 +135,9 @@ int sctp_rcv(struct sk_buff *skb)
 
         SCTP_INC_STATS_BH(SCTP_MIB_INSCTPPACKS);
 
+        if (skb_linearize(skb))
+                goto discard_it;
+
         sh = (struct sctphdr *) skb->h.raw;
 
         /* Pull up the IP and SCTP headers. */
@@ -768,6 +771,9 @@ static void __sctp_hash_established(struct sctp_association *asoc)
 /* Add an association to the hash. Local BH-safe. */
 void sctp_hash_established(struct sctp_association *asoc)
 {
+        if (asoc->temp)
+                return;
+
         sctp_local_bh_disable();
         __sctp_hash_established(asoc);
         sctp_local_bh_enable();
@@ -801,6 +807,9 @@ static void __sctp_unhash_established(struct sctp_association *asoc)
 /* Remove association from the hash table.  Local BH-safe. */
 void sctp_unhash_established(struct sctp_association *asoc)
 {
+        if (asoc->temp)
+                return;
+
         sctp_local_bh_disable();
         __sctp_unhash_established(asoc);
         sctp_local_bh_enable();
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 249e5033c1a8..78071c6e6cf1 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -215,17 +215,17 @@ static struct dst_entry *sctp_v6_get_dst(struct sctp_association *asoc,
         }
 
         dst = ip6_route_output(NULL, &fl);
-        if (dst) {
+        if (!dst->error) {
                 struct rt6_info *rt;
                 rt = (struct rt6_info *)dst;
                 SCTP_DEBUG_PRINTK(
                         "rt6_dst:" NIP6_FMT " rt6_src:" NIP6_FMT "\n",
                         NIP6(rt->rt6i_dst.addr), NIP6(rt->rt6i_src.addr));
-        } else {
-                SCTP_DEBUG_PRINTK("NO ROUTE\n");
+                return dst;
         }
-
-        return dst;
+        SCTP_DEBUG_PRINTK("NO ROUTE\n");
+        dst_release(dst);
+        return NULL;
 }
 
 /* Returns the number of consecutive initial bits that match in the 2 ipv6
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index a356d8d310a9..7f49e769080e 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -344,7 +344,7 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
                            assoc, sk, sctp_sk(sk)->type, sk->sk_state,
                            assoc->state, hash, assoc->assoc_id,
                            assoc->sndbuf_used,
-                           (sk->sk_rcvbuf - assoc->rwnd),
+                           atomic_read(&assoc->rmem_alloc),
                            sock_i_uid(sk), sock_i_ino(sk),
                            epb->bind_addr.port,
                            assoc->peer.port);
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index fac7674438a4..5b4f82fd98f8 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -591,7 +591,7 @@ static struct sock *sctp_v4_create_accept_sk(struct sock *sk,
         newinet->dport = htons(asoc->peer.port);
         newinet->daddr = asoc->peer.primary_addr.v4.sin_addr.s_addr;
         newinet->pmtudisc = inet->pmtudisc;
-        newinet->id = 0;
+        newinet->id = asoc->next_tsn ^ jiffies;
 
         newinet->uc_ttl = -1;
         newinet->mc_loop = 1;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 3fe906d65069..935bc9187fd8 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -821,7 +821,7 @@ out:
  * addrs is a pointer to an array of one or more socket addresses. Each
  * address is contained in its appropriate structure (i.e. struct
  * sockaddr_in or struct sockaddr_in6) the family of the address type
- * must be used to distengish the address length (note that this
+ * must be used to distinguish the address length (note that this
  * representation is termed a "packed array" of addresses). The caller
  * specifies the number of addresses in the array with addrcnt.
  *
@@ -3372,6 +3372,7 @@ SCTP_STATIC int sctp_do_peeloff(struct sctp_association *asoc,
 {
         struct sock *sk = asoc->base.sk;
         struct socket *sock;
+        struct inet_sock *inetsk;
         int err = 0;
 
         /* An association cannot be branched off from an already peeled-off
@@ -3389,6 +3390,14 @@ SCTP_STATIC int sctp_do_peeloff(struct sctp_association *asoc,
          * asoc to the newsk.
          */
         sctp_sock_migrate(sk, sock->sk, asoc, SCTP_SOCKET_UDP_HIGH_BANDWIDTH);
+
+        /* Make peeled-off sockets more like 1-1 accepted sockets.
+         * Set the daddr and initialize id to something more random
+         */
+        inetsk = inet_sk(sock->sk);
+        inetsk->daddr = asoc->peer.primary_addr.v4.sin_addr.s_addr;
+        inetsk->id = asoc->next_tsn ^ jiffies;
+
         *sockp = sock;
 
         return err;
@@ -5362,6 +5371,20 @@ static void sctp_wfree(struct sk_buff *skb)
         sctp_association_put(asoc);
 }
 
+/* Do accounting for the receive space on the socket.
+ * Accounting for the association is done in ulpevent.c
+ * We set this as a destructor for the cloned data skbs so that
+ * accounting is done at the correct time.
+ */
+void sctp_sock_rfree(struct sk_buff *skb)
+{
+        struct sock *sk = skb->sk;
+        struct sctp_ulpevent *event = sctp_skb2event(skb);
+
+        atomic_sub(event->rmem_len, &sk->sk_rmem_alloc);
+}
+
+
 /* Helper function to wait for space in the sndbuf.  */
 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
                                 size_t msg_len)
@@ -5634,10 +5657,10 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
                 event = sctp_skb2event(skb);
                 if (event->asoc == assoc) {
-                        sock_rfree(skb);
+                        sctp_sock_rfree(skb);
                         __skb_unlink(skb, &oldsk->sk_receive_queue);
                         __skb_queue_tail(&newsk->sk_receive_queue, skb);
-                        skb_set_owner_r(skb, newsk);
+                        sctp_skb_set_owner_r(skb, newsk);
                 }
         }
 
@@ -5665,10 +5688,10 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
                 sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
                         event = sctp_skb2event(skb);
                         if (event->asoc == assoc) {
-                                sock_rfree(skb);
+                                sctp_sock_rfree(skb);
                                 __skb_unlink(skb, &oldsp->pd_lobby);
                                 __skb_queue_tail(queue, skb);
-                                skb_set_owner_r(skb, newsk);
+                                sctp_skb_set_owner_r(skb, newsk);
                         }
                 }
 
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index ee236784a6bb..a015283a9087 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -55,10 +55,13 @@ static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event);
 
 
 /* Initialize an ULP event from an given skb.  */
-SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event, int msg_flags)
+SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event,
+                                    int msg_flags,
+                                    unsigned int len)
 {
         memset(event, 0, sizeof(struct sctp_ulpevent));
         event->msg_flags = msg_flags;
+        event->rmem_len = len;
 }
 
 /* Create a new sctp_ulpevent.  */
@@ -73,7 +76,7 @@ SCTP_STATIC struct sctp_ulpevent *sctp_ulpevent_new(int size, int msg_flags,
                 goto fail;
 
         event = sctp_skb2event(skb);
-        sctp_ulpevent_init(event, msg_flags);
+        sctp_ulpevent_init(event, msg_flags, skb->truesize);
 
         return event;
 
@@ -101,17 +104,16 @@ static inline void sctp_ulpevent_set_owner(struct sctp_ulpevent *event,
         sctp_association_hold((struct sctp_association *)asoc);
         skb = sctp_event2skb(event);
         event->asoc = (struct sctp_association *)asoc;
-        atomic_add(skb->truesize, &event->asoc->rmem_alloc);
-        skb_set_owner_r(skb, asoc->base.sk);
+        atomic_add(event->rmem_len, &event->asoc->rmem_alloc);
+        sctp_skb_set_owner_r(skb, asoc->base.sk);
 }
 
 /* A simple destructor to give up the reference to the association. */
 static inline void sctp_ulpevent_release_owner(struct sctp_ulpevent *event)
 {
         struct sctp_association *asoc = event->asoc;
-        struct sk_buff *skb = sctp_event2skb(event);
 
-        atomic_sub(skb->truesize, &asoc->rmem_alloc);
+        atomic_sub(event->rmem_len, &asoc->rmem_alloc);
         sctp_association_put(asoc);
 }
 
@@ -372,7 +374,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
 
         /* Embed the event fields inside the cloned skb.  */
         event = sctp_skb2event(skb);
-        sctp_ulpevent_init(event, MSG_NOTIFICATION);
+        sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
 
         sre = (struct sctp_remote_error *)
                 skb_push(skb, sizeof(struct sctp_remote_error));
@@ -464,7 +466,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
 
         /* Embed the event fields inside the cloned skb.  */
         event = sctp_skb2event(skb);
-        sctp_ulpevent_init(event, MSG_NOTIFICATION);
+        sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
 
         ssf = (struct sctp_send_failed *)
                 skb_push(skb, sizeof(struct sctp_send_failed));
@@ -682,8 +684,11 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
         /* Embed the event fields inside the cloned skb.  */
         event = sctp_skb2event(skb);
 
-        /* Initialize event with flags 0.  */
-        sctp_ulpevent_init(event, 0);
+        /* Initialize event with flags 0  and correct length
+         * Since this is a clone of the original skb, only account for
+         * the data of this chunk as other chunks will be accounted separately.
+         */
+        sctp_ulpevent_init(event, 0, skb->len + sizeof(struct sk_buff));
 
         sctp_ulpevent_receive_data(event, asoc);
 
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index 575e556aeb3e..e1d144275f97 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -309,7 +309,7 @@ static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *qu
                         if (!new)
                                 return NULL;    /* try again later */
 
-                        new->sk = f_frag->sk;
+                        sctp_skb_set_owner_r(new, f_frag->sk);
 
                         skb_shinfo(new)->frag_list = pos;
                 } else