21 files changed, 195 insertions, 147 deletions

diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 7ae6aa772dab..5b24ae0650d3 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -71,7 +71,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
                                           const struct sctp_endpoint *ep,
                                           const struct sock *sk,
                                           sctp_scope_t scope,
-                                          int gfp)
+                                          unsigned int __nocast gfp)
 {
         struct sctp_sock *sp;
         int i;
@@ -203,7 +203,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
          */
         asoc->addip_serial = asoc->c.initial_tsn;
 
-        skb_queue_head_init(&asoc->addip_chunks);
+        INIT_LIST_HEAD(&asoc->addip_chunk_list);
 
         /* Make an empty list of remote transport addresses.  */
         INIT_LIST_HEAD(&asoc->peer.transport_addr_list);
@@ -272,7 +272,8 @@ fail_init:
 /* Allocate and initialize a new association */
 struct sctp_association *sctp_association_new(const struct sctp_endpoint *ep,
                                          const struct sock *sk,
-                                         sctp_scope_t scope, int gfp)
+                                         sctp_scope_t scope,
+                                         unsigned int __nocast gfp)
 {
         struct sctp_association *asoc;
 
@@ -478,7 +479,7 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
 /* Add a transport address to an association.  */
 struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
                                            const union sctp_addr *addr,
-                                           const int gfp,
+                                           const unsigned int __nocast gfp,
                                            const int peer_state)
 {
         struct sctp_transport *peer;
@@ -1229,7 +1230,8 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned len)
 /* Build the bind address list for the association based on info from the
  * local endpoint and the remote peer.
  */
-int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc, int gfp)
+int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc,
+                                     unsigned int __nocast gfp)
 {
         sctp_scope_t scope;
         int flags;
@@ -1251,7 +1253,8 @@ int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc, int gfp)
 
 /* Build the association's bind address list from the cookie.  */
 int sctp_assoc_set_bind_addr_from_cookie(struct sctp_association *asoc,
-                                         struct sctp_cookie *cookie, int gfp)
+                                         struct sctp_cookie *cookie,
+                                         unsigned int __nocast gfp)
 {
         int var_size2 = ntohs(cookie->peer_init->chunk_hdr.length);
         int var_size3 = cookie->raw_addr_list_len;
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index f90eadfb60a2..f71549710f2e 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -53,7 +53,8 @@
 
 /* Forward declarations for internal helpers. */
 static int sctp_copy_one_addr(struct sctp_bind_addr *, union sctp_addr *,
-                              sctp_scope_t scope, int gfp, int flags);
+                              sctp_scope_t scope, unsigned int __nocast gfp,
+                              int flags);
 static void sctp_bind_addr_clean(struct sctp_bind_addr *);
 
 /* First Level Abstractions. */
@@ -63,7 +64,8 @@ static void sctp_bind_addr_clean(struct sctp_bind_addr *);
  */
 int sctp_bind_addr_copy(struct sctp_bind_addr *dest, 
                         const struct sctp_bind_addr *src,
-                        sctp_scope_t scope, int gfp, int flags)
+                        sctp_scope_t scope, unsigned int __nocast gfp,
+                        int flags)
 {
         struct sctp_sockaddr_entry *addr;
         struct list_head *pos;
@@ -144,7 +146,7 @@ void sctp_bind_addr_free(struct sctp_bind_addr *bp)
 
 /* Add an address to the bind address list in the SCTP_bind_addr structure. */
 int sctp_add_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *new,
-                       int gfp)
+                       unsigned int __nocast gfp)
 {
         struct sctp_sockaddr_entry *addr;
 
@@ -197,7 +199,8 @@ int sctp_del_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *del_addr)
  * The second argument is the return value for the length.
  */
 union sctp_params sctp_bind_addrs_to_raw(const struct sctp_bind_addr *bp,
-                                         int *addrs_len, int gfp)
+                                         int *addrs_len,
+                                         unsigned int __nocast gfp)
 {
         union sctp_params addrparms;
         union sctp_params retval;
@@ -249,7 +252,7 @@ end_raw:
  * address parameters).
  */
 int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
-                           int addrs_len, __u16 port, int gfp)
+                           int addrs_len, __u16 port, unsigned int __nocast gfp)
 {
         union sctp_addr_param *rawaddr;
         struct sctp_paramhdr *param;
@@ -347,7 +350,8 @@ union sctp_addr *sctp_find_unmatch_addr(struct sctp_bind_addr	*bp,
 /* Copy out addresses from the global local address list. */
 static int sctp_copy_one_addr(struct sctp_bind_addr *dest, 
                               union sctp_addr *addr,
-                              sctp_scope_t scope, int gfp, int flags)
+                              sctp_scope_t scope, unsigned int __nocast gfp,
+                              int flags)
 {
         int error = 0;
 
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 0c2ab7885058..61da2937e641 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -62,7 +62,7 @@ static void sctp_datamsg_init(struct sctp_datamsg *msg)
 }
 
 /* Allocate and initialize datamsg. */
-SCTP_STATIC struct sctp_datamsg *sctp_datamsg_new(int gfp)
+SCTP_STATIC struct sctp_datamsg *sctp_datamsg_new(unsigned int __nocast gfp)
 {
         struct sctp_datamsg *msg;
         msg = kmalloc(sizeof(struct sctp_datamsg), gfp);
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 2ec0320fac3b..e47ac0d1a6d6 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -67,7 +67,8 @@ static void sctp_endpoint_bh_rcv(struct sctp_endpoint *ep);
  * Initialize the base fields of the endpoint structure.
  */
 static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
-                                                struct sock *sk, int gfp)
+                                                struct sock *sk,
+                                                unsigned int __nocast gfp)
 {
         struct sctp_sock *sp = sctp_sk(sk);
         memset(ep, 0, sizeof(struct sctp_endpoint));
@@ -102,9 +103,9 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         /* Set up the base timeout information.  */
         ep->timeouts[SCTP_EVENT_TIMEOUT_NONE] = 0;
         ep->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] =
-                SCTP_DEFAULT_TIMEOUT_T1_COOKIE;
+                msecs_to_jiffies(sp->rtoinfo.srto_initial);
         ep->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] =
-                SCTP_DEFAULT_TIMEOUT_T1_INIT;
+                msecs_to_jiffies(sp->rtoinfo.srto_initial);
         ep->timeouts[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN] =
                 msecs_to_jiffies(sp->rtoinfo.srto_initial);
         ep->timeouts[SCTP_EVENT_TIMEOUT_T3_RTX] = 0;
@@ -117,12 +118,9 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         ep->timeouts[SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD]
                 = 5 * msecs_to_jiffies(sp->rtoinfo.srto_max);
 
-        ep->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] =
-                SCTP_DEFAULT_TIMEOUT_HEARTBEAT;
-        ep->timeouts[SCTP_EVENT_TIMEOUT_SACK] =
-                SCTP_DEFAULT_TIMEOUT_SACK;
-        ep->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
-                sp->autoclose * HZ;
+        ep->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] = 0;
+        ep->timeouts[SCTP_EVENT_TIMEOUT_SACK] = sctp_sack_timeout;
+        ep->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] = sp->autoclose * HZ;
 
         /* Use SCTP specific send buffer space queues.  */
         ep->sndbuf_policy = sctp_sndbuf_policy;
@@ -140,7 +138,8 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
 /* Create a sctp_endpoint with all that boring stuff initialized.
  * Returns NULL if there isn't enough memory.
  */
-struct sctp_endpoint *sctp_endpoint_new(struct sock *sk, int gfp)
+struct sctp_endpoint *sctp_endpoint_new(struct sock *sk,
+                                        unsigned int __nocast gfp)
 {
         struct sctp_endpoint *ep;
 
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 339f7acfdb64..742be9171b7d 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -115,6 +115,17 @@ static void sctp_rcv_set_owner_r(struct sk_buff *skb, struct sock *sk)
         atomic_add(sizeof(struct sctp_chunk),&sk->sk_rmem_alloc);
 }
 
+struct sctp_input_cb {
+        union {
+                struct inet_skb_parm    h4;
+#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
+                struct inet6_skb_parm   h6;
+#endif
+        } header;
+        struct sctp_chunk *chunk;
+};
+#define SCTP_INPUT_CB(__skb)    ((struct sctp_input_cb *)&((__skb)->cb[0]))
+
 /*
  * This is the routine which IP calls when receiving an SCTP packet.
  */
@@ -243,6 +254,7 @@ int sctp_rcv(struct sk_buff *skb)
                 ret = -ENOMEM;
                 goto discard_release;
         }
+        SCTP_INPUT_CB(skb)->chunk = chunk;
 
         sctp_rcv_set_owner_r(skb,sk);
 
@@ -265,9 +277,9 @@ int sctp_rcv(struct sk_buff *skb)
         sctp_bh_lock_sock(sk);
 
         if (sock_owned_by_user(sk))
-                sk_add_backlog(sk, (struct sk_buff *) chunk);
+                sk_add_backlog(sk, skb);
         else
-                sctp_backlog_rcv(sk, (struct sk_buff *) chunk);
+                sctp_backlog_rcv(sk, skb);
 
         /* Release the sock and any reference counts we took in the
          * lookup calls.
@@ -302,14 +314,8 @@ discard_release:
  */
 int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
-        struct sctp_chunk *chunk;
-        struct sctp_inq *inqueue;
-
-        /* One day chunk will live inside the skb, but for
-         * now this works.
-         */
-        chunk = (struct sctp_chunk *) skb;
-        inqueue = &chunk->rcvr->inqueue;
+        struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
+        struct sctp_inq *inqueue = &chunk->rcvr->inqueue;
 
         sctp_inq_push(inqueue, chunk);
         return 0;
@@ -345,7 +351,6 @@ void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
  *
  */
 void sctp_icmp_proto_unreachable(struct sock *sk,
-                           struct sctp_endpoint *ep,
                            struct sctp_association *asoc,
                            struct sctp_transport *t)
 {
@@ -361,7 +366,6 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 /* Common lookup code for icmp/icmpv6 error handler. */
 struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
                              struct sctphdr *sctphdr,
-                             struct sctp_endpoint **epp,
                              struct sctp_association **app,
                              struct sctp_transport **tpp)
 {
@@ -369,11 +373,10 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
         union sctp_addr daddr;
         struct sctp_af *af;
         struct sock *sk = NULL;
-        struct sctp_endpoint *ep = NULL;
         struct sctp_association *asoc = NULL;
         struct sctp_transport *transport = NULL;
 
-        *app = NULL; *epp = NULL; *tpp = NULL;
+        *app = NULL; *tpp = NULL;
 
         af = sctp_get_af_specific(family);
         if (unlikely(!af)) {
@@ -388,26 +391,15 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
          * packet.
          */
         asoc = __sctp_lookup_association(&saddr, &daddr, &transport);
-        if (!asoc) {
-                /* If there is no matching association, see if it matches any
-                 * endpoint. This may happen for an ICMP error generated in
-                 * response to an INIT_ACK.
-                 */
-                ep = __sctp_rcv_lookup_endpoint(&daddr);
-                if (!ep) {
-                        return NULL;
-                }
-        }
+        if (!asoc)
+                return NULL;
 
-        if (asoc) {
-                sk = asoc->base.sk;
+        sk = asoc->base.sk;
 
-                if (ntohl(sctphdr->vtag) != asoc->c.peer_vtag) {
-                        ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
-                        goto out;
-                }
-        } else
-                sk = ep->base.sk;
+        if (ntohl(sctphdr->vtag) != asoc->c.peer_vtag) {
+                ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
+                goto out;
+        }
 
         sctp_bh_lock_sock(sk);
 
@@ -417,7 +409,6 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
         if (sock_owned_by_user(sk))
                 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 
-        *epp = ep;
         *app = asoc;
         *tpp = transport;
         return sk;
@@ -426,21 +417,16 @@ out:
         sock_put(sk);
         if (asoc)
                 sctp_association_put(asoc);
-        if (ep)
-                sctp_endpoint_put(ep);
         return NULL;
 }
 
 /* Common cleanup code for icmp/icmpv6 error handler. */
-void sctp_err_finish(struct sock *sk, struct sctp_endpoint *ep,
-                     struct sctp_association *asoc)
+void sctp_err_finish(struct sock *sk, struct sctp_association *asoc)
 {
         sctp_bh_unlock_sock(sk);
         sock_put(sk);
         if (asoc)
                 sctp_association_put(asoc);
-        if (ep)
-                sctp_endpoint_put(ep);
 }
 
 /*
@@ -465,7 +451,6 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         int type = skb->h.icmph->type;
         int code = skb->h.icmph->code;
         struct sock *sk;
-        struct sctp_endpoint *ep;
         struct sctp_association *asoc;
         struct sctp_transport *transport;
         struct inet_sock *inet;
@@ -482,7 +467,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         savesctp  = skb->h.raw;
         skb->nh.iph = iph;
         skb->h.raw = (char *)sh;
-        sk = sctp_err_lookup(AF_INET, skb, sh, &ep, &asoc, &transport);
+        sk = sctp_err_lookup(AF_INET, skb, sh, &asoc, &transport);
         /* Put back, the original pointers. */
         skb->nh.raw = saveip;
         skb->h.raw = savesctp;
@@ -509,7 +494,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
                 }
                 else {
                         if (ICMP_PROT_UNREACH == code) {
-                                sctp_icmp_proto_unreachable(sk, ep, asoc,
+                                sctp_icmp_proto_unreachable(sk, asoc,
                                                             transport);
                                 goto out_unlock;
                         }
@@ -538,7 +523,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         }
 
 out_unlock:
-        sctp_err_finish(sk, ep, asoc);
+        sctp_err_finish(sk, asoc);
 }
 
 /*
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index cedf4351556c..2d33922c044b 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -50,7 +50,7 @@
 /* Initialize an SCTP inqueue.  */
 void sctp_inq_init(struct sctp_inq *queue)
 {
-        skb_queue_head_init(&queue->in);
+        INIT_LIST_HEAD(&queue->in_chunk_list);
         queue->in_progress = NULL;
 
         /* Create a task for delivering data.  */
@@ -62,11 +62,13 @@ void sctp_inq_init(struct sctp_inq *queue)
 /* Release the memory associated with an SCTP inqueue.  */
 void sctp_inq_free(struct sctp_inq *queue)
 {
-        struct sctp_chunk *chunk;
+        struct sctp_chunk *chunk, *tmp;
 
         /* Empty the queue.  */
-        while ((chunk = (struct sctp_chunk *) skb_dequeue(&queue->in)) != NULL)
+        list_for_each_entry_safe(chunk, tmp, &queue->in_chunk_list, list) {
+                list_del_init(&chunk->list);
                 sctp_chunk_free(chunk);
+        }
 
         /* If there is a packet which is currently being worked on,
          * free it as well.
@@ -92,7 +94,7 @@ void sctp_inq_push(struct sctp_inq *q, struct sctp_chunk *packet)
          * Eventually, we should clean up inqueue to not rely
          * on the BH related data structures.
          */
-        skb_queue_tail(&(q->in), (struct sk_buff *) packet);
+        list_add_tail(&packet->list, &q->in_chunk_list);
         q->immediate.func(q->immediate.data);
 }
 
@@ -131,12 +133,16 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
 
         /* Do we need to take the next packet out of the queue to process? */
         if (!chunk) {
+                struct list_head *entry;
+
                 /* Is the queue empty?  */
-                if (skb_queue_empty(&queue->in))
+                if (list_empty(&queue->in_chunk_list))
                         return NULL;
 
+                entry = queue->in_chunk_list.next;
                 chunk = queue->in_progress =
-                        (struct sctp_chunk *) skb_dequeue(&queue->in);
+                        list_entry(entry, struct sctp_chunk, list);
+                list_del_init(entry);
 
                 /* This is the first chunk in the packet.  */
                 chunk->singleton = 1;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index c7e42d125b9c..e9b2fd480d61 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -91,7 +91,6 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct ipv6hdr *iph = (struct ipv6hdr *)skb->data;
         struct sctphdr *sh = (struct sctphdr *)(skb->data + offset);
         struct sock *sk;
-        struct sctp_endpoint *ep;
         struct sctp_association *asoc;
         struct sctp_transport *transport;
         struct ipv6_pinfo *np;
@@ -105,7 +104,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         savesctp  = skb->h.raw;
         skb->nh.ipv6h = iph;
         skb->h.raw = (char *)sh;
-        sk = sctp_err_lookup(AF_INET6, skb, sh, &ep, &asoc, &transport);
+        sk = sctp_err_lookup(AF_INET6, skb, sh, &asoc, &transport);
         /* Put back, the original pointers. */
         skb->nh.raw = saveip;
         skb->h.raw = savesctp;
@@ -124,7 +123,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 goto out_unlock;
         case ICMPV6_PARAMPROB:
                 if (ICMPV6_UNK_NEXTHDR == code) {
-                        sctp_icmp_proto_unreachable(sk, ep, asoc, transport);
+                        sctp_icmp_proto_unreachable(sk, asoc, transport);
                         goto out_unlock;
                 }
                 break;
@@ -142,7 +141,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         }
 
 out_unlock:
-        sctp_err_finish(sk, ep, asoc);
+        sctp_err_finish(sk, asoc);
 out:
         if (likely(idev != NULL))
                 in6_dev_put(idev);
diff --git a/net/sctp/objcnt.c b/net/sctp/objcnt.c
index 0781e5d509fd..8ff588f0d76a 100644
--- a/net/sctp/objcnt.c
+++ b/net/sctp/objcnt.c
@@ -127,8 +127,12 @@ done:
 /* Initialize the objcount in the proc filesystem.  */
 void sctp_dbg_objcnt_init(void)
 {
-        create_proc_read_entry("sctp_dbg_objcnt", 0, proc_net_sctp,
+        struct proc_dir_entry *ent;
+        ent = create_proc_read_entry("sctp_dbg_objcnt", 0, proc_net_sctp,
                                sctp_dbg_objcnt_read, NULL);
+        if (!ent)
+                printk(KERN_WARNING 
+                        "sctp_dbg_objcnt: Unable to create /proc entry.\n");
 }
 
 /* Cleanup the objcount entry in the proc filesystem.  */
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 84b5b370b09d..931371633464 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -108,7 +108,7 @@ struct sctp_packet *sctp_packet_init(struct sctp_packet *packet,
         packet->transport = transport;
         packet->source_port = sport;
         packet->destination_port = dport;
-        skb_queue_head_init(&packet->chunks);
+        INIT_LIST_HEAD(&packet->chunk_list);
         if (asoc) {
                 struct sctp_sock *sp = sctp_sk(asoc->base.sk);  
                 overhead = sp->pf->af->net_header_len; 
@@ -129,12 +129,14 @@ struct sctp_packet *sctp_packet_init(struct sctp_packet *packet,
 /* Free a packet.  */
 void sctp_packet_free(struct sctp_packet *packet)
 {
-        struct sctp_chunk *chunk;
+        struct sctp_chunk *chunk, *tmp;
 
         SCTP_DEBUG_PRINTK("%s: packet:%p\n", __FUNCTION__, packet);
 
-        while ((chunk = (struct sctp_chunk *)__skb_dequeue(&packet->chunks)) != NULL)
+        list_for_each_entry_safe(chunk, tmp, &packet->chunk_list, list) {
+                list_del_init(&chunk->list);
                 sctp_chunk_free(chunk);
+        }
 
         if (packet->malloced)
                 kfree(packet);
@@ -276,7 +278,7 @@ append:
                 packet->has_sack = 1;
 
         /* It is OK to send this chunk.  */
-        __skb_queue_tail(&packet->chunks, (struct sk_buff *)chunk);
+        list_add_tail(&chunk->list, &packet->chunk_list);
         packet->size += chunk_len;
         chunk->transport = packet->transport;
 finish:
@@ -295,7 +297,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         struct sctphdr *sh;
         __u32 crc32;
         struct sk_buff *nskb;
-        struct sctp_chunk *chunk;
+        struct sctp_chunk *chunk, *tmp;
         struct sock *sk;
         int err = 0;
         int padding;            /* How much padding do we need?  */
@@ -305,11 +307,11 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         SCTP_DEBUG_PRINTK("%s: packet:%p\n", __FUNCTION__, packet);
 
         /* Do NOT generate a chunkless packet. */
-        chunk = (struct sctp_chunk *)skb_peek(&packet->chunks);
-        if (unlikely(!chunk))
+        if (list_empty(&packet->chunk_list))
                 return err;
 
         /* Set up convenience variables... */
+        chunk = list_entry(packet->chunk_list.next, struct sctp_chunk, list);
         sk = chunk->skb->sk;
 
         /* Allocate the new skb.  */
@@ -370,7 +372,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
          * [This whole comment explains WORD_ROUND() below.]
          */
         SCTP_DEBUG_PRINTK("***sctp_transmit_packet***\n");
-        while ((chunk = (struct sctp_chunk *)__skb_dequeue(&packet->chunks)) != NULL) {
+        list_for_each_entry_safe(chunk, tmp, &packet->chunk_list, list) {
+                list_del_init(&chunk->list);
                 if (sctp_chunk_is_data(chunk)) {
 
                         if (!chunk->has_tsn) {
@@ -511,7 +514,8 @@ err:
          * will get resent or dropped later.
          */
 
-        while ((chunk = (struct sctp_chunk *)__skb_dequeue(&packet->chunks)) != NULL) {
+        list_for_each_entry_safe(chunk, tmp, &packet->chunk_list, list) {
+                list_del_init(&chunk->list);
                 if (!sctp_chunk_is_data(chunk))
                         sctp_chunk_free(chunk);
         }
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 4eb81a1407b7..efb72faba20c 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -75,7 +75,7 @@ static void sctp_generate_fwdtsn(struct sctp_outq *q, __u32 sack_ctsn);
 static inline void sctp_outq_head_data(struct sctp_outq *q,
                                         struct sctp_chunk *ch)
 {
-        __skb_queue_head(&q->out, (struct sk_buff *)ch);
+        list_add(&ch->list, &q->out_chunk_list);
         q->out_qlen += ch->skb->len;
         return;
 }
@@ -83,17 +83,22 @@ static inline void sctp_outq_head_data(struct sctp_outq *q,
 /* Take data from the front of the queue. */
 static inline struct sctp_chunk *sctp_outq_dequeue_data(struct sctp_outq *q)
 {
-        struct sctp_chunk *ch;
-        ch = (struct sctp_chunk *)__skb_dequeue(&q->out);
-        if (ch)
+        struct sctp_chunk *ch = NULL;
+
+        if (!list_empty(&q->out_chunk_list)) {
+                struct list_head *entry = q->out_chunk_list.next;
+
+                ch = list_entry(entry, struct sctp_chunk, list);
+                list_del_init(entry);
                 q->out_qlen -= ch->skb->len;
+        }
         return ch;
 }
 /* Add data chunk to the end of the queue. */
 static inline void sctp_outq_tail_data(struct sctp_outq *q,
                                        struct sctp_chunk *ch)
 {
-        __skb_queue_tail(&q->out, (struct sk_buff *)ch);
+        list_add_tail(&ch->list, &q->out_chunk_list);
         q->out_qlen += ch->skb->len;
         return;
 }
@@ -197,8 +202,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
 void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
 {
         q->asoc = asoc;
-        skb_queue_head_init(&q->out);
-        skb_queue_head_init(&q->control);
+        INIT_LIST_HEAD(&q->out_chunk_list);
+        INIT_LIST_HEAD(&q->control_chunk_list);
         INIT_LIST_HEAD(&q->retransmit);
         INIT_LIST_HEAD(&q->sacked);
         INIT_LIST_HEAD(&q->abandoned);
@@ -217,7 +222,7 @@ void sctp_outq_teardown(struct sctp_outq *q)
 {
         struct sctp_transport *transport;
         struct list_head *lchunk, *pos, *temp;
-        struct sctp_chunk *chunk;
+        struct sctp_chunk *chunk, *tmp;
 
         /* Throw away unacknowledged chunks. */
         list_for_each(pos, &q->asoc->peer.transport_addr_list) {
@@ -269,8 +274,10 @@ void sctp_outq_teardown(struct sctp_outq *q)
         q->error = 0;
 
         /* Throw away any leftover control chunks. */
-        while ((chunk = (struct sctp_chunk *) skb_dequeue(&q->control)) != NULL)
+        list_for_each_entry_safe(chunk, tmp, &q->control_chunk_list, list) {
+                list_del_init(&chunk->list);
                 sctp_chunk_free(chunk);
+        }
 }
 
 /* Free the outqueue structure and any related pending chunks.  */
@@ -333,7 +340,7 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
                         break;
                 };
         } else {
-                __skb_queue_tail(&q->control, (struct sk_buff *) chunk);
+                list_add_tail(&chunk->list, &q->control_chunk_list);
                 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
         }
 
@@ -650,10 +657,9 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
         __u16 sport = asoc->base.bind_addr.port;
         __u16 dport = asoc->peer.port;
         __u32 vtag = asoc->peer.i.init_tag;
-        struct sk_buff_head *queue;
         struct sctp_transport *transport = NULL;
         struct sctp_transport *new_transport;
-        struct sctp_chunk *chunk;
+        struct sctp_chunk *chunk, *tmp;
         sctp_xmit_t status;
         int error = 0;
         int start_timer = 0;
@@ -675,8 +681,9 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
          *   ...
          */
 
-        queue = &q->control;
-        while ((chunk = (struct sctp_chunk *)skb_dequeue(queue)) != NULL) {
+        list_for_each_entry_safe(chunk, tmp, &q->control_chunk_list, list) {
+                list_del_init(&chunk->list);
+
                 /* Pick the right transport to use. */
                 new_transport = chunk->transport;
 
@@ -814,8 +821,6 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
 
                 /* Finally, transmit new packets.  */
                 start_timer = 0;
-                queue = &q->out;
-
                 while ((chunk = sctp_outq_dequeue_data(q)) != NULL) {
                         /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
                          * stream identifier.
@@ -1149,8 +1154,9 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
         /* See if all chunks are acked.
          * Make sure the empty queue handler will get run later.
          */
-        q->empty = skb_queue_empty(&q->out) && skb_queue_empty(&q->control) &&
-                        list_empty(&q->retransmit);
+        q->empty = (list_empty(&q->out_chunk_list) &&
+                    list_empty(&q->control_chunk_list) &&
+                    list_empty(&q->retransmit));
         if (!q->empty)
                 goto finish;
 
@@ -1679,9 +1685,9 @@ static void sctp_generate_fwdtsn(struct sctp_outq *q, __u32 ctsn)
                 if (TSN_lte(tsn, ctsn)) {
                         list_del_init(lchunk);
                         if (!chunk->tsn_gap_acked) {
-                        chunk->transport->flight_size -=
-                                                 sctp_data_size(chunk);
-                        q->outstanding_bytes -= sctp_data_size(chunk);
+                                chunk->transport->flight_size -=
+                                        sctp_data_size(chunk);
+                                q->outstanding_bytes -= sctp_data_size(chunk);
                         }
                         sctp_chunk_free(chunk);
                 } else {
@@ -1729,7 +1735,7 @@ static void sctp_generate_fwdtsn(struct sctp_outq *q, __u32 ctsn)
                                               nskips, &ftsn_skip_arr[0]); 
 
         if (ftsn_chunk) {
-                __skb_queue_tail(&q->control, (struct sk_buff *)ftsn_chunk);
+                list_add_tail(&ftsn_chunk->list, &q->control_chunk_list);
                 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
         }
 }
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 98d49ec9b74b..b74f7772b576 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -57,6 +57,7 @@ static struct snmp_mib sctp_snmp_list[] = {
         SNMP_MIB_ITEM("SctpReasmUsrMsgs", SCTP_MIB_REASMUSRMSGS),
         SNMP_MIB_ITEM("SctpOutSCTPPacks", SCTP_MIB_OUTSCTPPACKS),
         SNMP_MIB_ITEM("SctpInSCTPPacks", SCTP_MIB_INSCTPPACKS),
+        SNMP_MIB_SENTINEL
 };
 
 /* Return the current value of a particular entry in the mib by adding its
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 5135e1a25d25..ce9245e71fca 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -219,7 +219,7 @@ static void sctp_free_local_addr_list(void)
 
 /* Copy the local addresses which are valid for 'scope' into 'bp'.  */
 int sctp_copy_local_addr_list(struct sctp_bind_addr *bp, sctp_scope_t scope,
-                              int gfp, int copy_flags)
+                              unsigned int __nocast gfp, int copy_flags)
 {
         struct sctp_sockaddr_entry *addr;
         int error = 0;
@@ -1050,7 +1050,10 @@ SCTP_STATIC __init int sctp_init(void)
         sctp_sndbuf_policy              = 0;
 
         /* HB.interval              - 30 seconds */
-        sctp_hb_interval                = 30 * HZ;
+        sctp_hb_interval                = SCTP_DEFAULT_TIMEOUT_HEARTBEAT;
+
+        /* delayed SACK timeout */
+        sctp_sack_timeout               = SCTP_DEFAULT_TIMEOUT_SACK;
 
         /* Implementation specific variables. */
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 5baed9bb7de5..00d32b7c8266 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -78,7 +78,7 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
 static int sctp_process_param(struct sctp_association *asoc,
                               union sctp_params param,
                               const union sctp_addr *peer_addr,
-                              int gfp);
+                              unsigned int __nocast gfp);
 
 /* What was the inbound interface for this chunk? */
 int sctp_chunk_iif(const struct sctp_chunk *chunk)
@@ -174,7 +174,7 @@ void  sctp_init_cause(struct sctp_chunk *chunk, __u16 cause_code,
  */
 struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
                              const struct sctp_bind_addr *bp,
-                             int gfp, int vparam_len)
+                             unsigned int __nocast gfp, int vparam_len)
 {
         sctp_inithdr_t init;
         union sctp_params addrs;
@@ -261,7 +261,7 @@ nodata:
 
 struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
                                  const struct sctp_chunk *chunk,
-                                 int gfp, int unkparam_len)
+                                 unsigned int __nocast gfp, int unkparam_len)
 {
         sctp_inithdr_t initack;
         struct sctp_chunk *retval;
@@ -1003,6 +1003,7 @@ struct sctp_chunk *sctp_chunkify(struct sk_buff *skb,
                 SCTP_DEBUG_PRINTK("chunkifying skb %p w/o an sk\n", skb);
         }
 
+        INIT_LIST_HEAD(&retval->list);
         retval->skb             = skb;
         retval->asoc            = (struct sctp_association *)asoc;
         retval->resent          = 0;
@@ -1116,8 +1117,7 @@ static void sctp_chunk_destroy(struct sctp_chunk *chunk)
 /* Possibly, free the chunk.  */
 void sctp_chunk_free(struct sctp_chunk *chunk)
 {
-        /* Make sure that we are not on any list.  */
-        skb_unlink((struct sk_buff *) chunk);
+        BUG_ON(!list_empty(&chunk->list));
         list_del_init(&chunk->transmitted_list);
 
         /* Release our reference on the message tracker. */
@@ -1233,7 +1233,8 @@ void sctp_chunk_assign_tsn(struct sctp_chunk *chunk)
 
 /* Create a CLOSED association to use with an incoming packet.  */
 struct sctp_association *sctp_make_temp_asoc(const struct sctp_endpoint *ep,
-                                        struct sctp_chunk *chunk, int gfp)
+                                        struct sctp_chunk *chunk,
+                                        unsigned int __nocast gfp)
 {
         struct sctp_association *asoc;
         struct sk_buff *skb;
@@ -1348,7 +1349,7 @@ nodata:
 struct sctp_association *sctp_unpack_cookie(
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
-        struct sctp_chunk *chunk, int gfp,
+        struct sctp_chunk *chunk, unsigned int __nocast gfp,
         int *error, struct sctp_chunk **errp)
 {
         struct sctp_association *retval = NULL;
@@ -1812,7 +1813,7 @@ int sctp_verify_init(const struct sctp_association *asoc,
  */
 int sctp_process_init(struct sctp_association *asoc, sctp_cid_t cid,
                       const union sctp_addr *peer_addr,
-                      sctp_init_chunk_t *peer_init, int gfp)
+                      sctp_init_chunk_t *peer_init, unsigned int __nocast gfp)
 {
         union sctp_params param;
         struct sctp_transport *transport;
@@ -1983,7 +1984,7 @@ nomem:
 static int sctp_process_param(struct sctp_association *asoc,
                               union sctp_params param,
                               const union sctp_addr *peer_addr,
-                              int gfp)
+                              unsigned int __nocast gfp)
 {
         union sctp_addr addr;
         int i;
@@ -2739,8 +2740,12 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
         asoc->addip_last_asconf = NULL;
 
         /* Send the next asconf chunk from the addip chunk queue. */
-        asconf = (struct sctp_chunk *)__skb_dequeue(&asoc->addip_chunks);
-        if (asconf) {
+        if (!list_empty(&asoc->addip_chunk_list)) {
+                struct list_head *entry = asoc->addip_chunk_list.next;
+                asconf = list_entry(entry, struct sctp_chunk, list);
+
+                list_del_init(entry);
+
                 /* Hold the chunk until an ASCONF_ACK is received. */
                 sctp_chunk_hold(asconf);
                 if (sctp_primitive_ASCONF(asoc, asconf))
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 778639db125a..39c970b5b198 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -63,7 +63,7 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                                 void *event_arg,
                                 sctp_disposition_t status,
                                 sctp_cmd_seq_t *commands,
-                                int gfp);
+                                unsigned int __nocast gfp);
 static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
                              sctp_state_t state,
                              struct sctp_endpoint *ep,
@@ -71,7 +71,7 @@ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
                              void *event_arg,
                              sctp_disposition_t status,
                              sctp_cmd_seq_t *commands,
-                             int gfp);
+                             unsigned int __nocast gfp);
 
 /********************************************************************
  * Helper functions
@@ -497,7 +497,8 @@ static void sctp_cmd_assoc_failed(sctp_cmd_seq_t *commands,
 static int sctp_cmd_process_init(sctp_cmd_seq_t *commands,
                                  struct sctp_association *asoc,
                                  struct sctp_chunk *chunk,
-                                 sctp_init_chunk_t *peer_init, int gfp)
+                                 sctp_init_chunk_t *peer_init,
+                                 unsigned int __nocast gfp)
 {
         int error;
 
@@ -852,7 +853,7 @@ int sctp_do_sm(sctp_event_t event_type, sctp_subtype_t subtype,
                struct sctp_endpoint *ep,
                struct sctp_association *asoc,
                void *event_arg,
-               int gfp)
+               unsigned int __nocast gfp)
 {
         sctp_cmd_seq_t commands;
         const sctp_sm_table_entry_t *state_fn;
@@ -897,7 +898,7 @@ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
                              void *event_arg,
                              sctp_disposition_t status,
                              sctp_cmd_seq_t *commands,
-                             int gfp)
+                             unsigned int __nocast gfp)
 {
         int error;
 
@@ -985,7 +986,7 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                                 void *event_arg,
                                 sctp_disposition_t status,
                                 sctp_cmd_seq_t *commands,
-                                int gfp)
+                                unsigned int __nocast gfp)
 {
         int error = 0;
         int force;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 058189684c7c..86073df418f5 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -92,6 +92,17 @@ static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
                                              sctp_cmd_seq_t *commands);
 static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
 
+static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
+                                           __u16 error,
+                                           const struct sctp_association *asoc,
+                                           struct sctp_transport *transport);
+
+static sctp_disposition_t sctp_sf_violation_chunklen(
+                                     const struct sctp_endpoint *ep,
+                                     const struct sctp_association *asoc,
+                                     const sctp_subtype_t type,
+                                     void *arg,
+                                     sctp_cmd_seq_t *commands);
 
 /* Small helper function that checks if the chunk length
  * is of the appropriate length.  The 'required_length' argument
@@ -2328,7 +2339,7 @@ sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
  *
  * This is common code called by several sctp_sf_*_abort() functions above.
  */
-sctp_disposition_t  sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
+static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
                                            __u16 error,
                                            const struct sctp_association *asoc,
                                            struct sctp_transport *transport)
@@ -3687,7 +3698,8 @@ sctp_disposition_t sctp_sf_violation(const struct sctp_endpoint *ep,
  *
  * Generate an  ABORT chunk and terminate the association.
  */
-sctp_disposition_t sctp_sf_violation_chunklen(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_violation_chunklen(
+                                     const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
                                      void *arg,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index aad55dc3792b..091a66f06a35 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -406,7 +406,7 @@ static int sctp_send_asconf(struct sctp_association *asoc,
          * transmission.
          */     
         if (asoc->addip_last_asconf) {
-                __skb_queue_tail(&asoc->addip_chunks, (struct sk_buff *)chunk);
+                list_add_tail(&chunk->list, &asoc->addip_chunk_list);
                 goto out;       
         }
 
diff --git a/net/sctp/ssnmap.c b/net/sctp/ssnmap.c
index e627d2b451b6..25037daf3fa0 100644
--- a/net/sctp/ssnmap.c
+++ b/net/sctp/ssnmap.c
@@ -57,7 +57,8 @@ static inline size_t sctp_ssnmap_size(__u16 in, __u16 out)
 /* Create a new sctp_ssnmap.
  * Allocate room to store at least 'len' contiguous TSNs.
  */
-struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out, int gfp)
+struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
+                                    unsigned int __nocast gfp)
 {
         struct sctp_ssnmap *retval;
         int size;
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 7fc31849312b..dc4893474f18 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -47,6 +47,8 @@
 static ctl_handler sctp_sysctl_jiffies_ms;
 static long rto_timer_min = 1;
 static long rto_timer_max = 86400000; /* One day */
+static long sack_timer_min = 1;
+static long sack_timer_max = 500;
 
 static ctl_table sctp_table[] = {
         {
@@ -187,6 +189,17 @@ static ctl_table sctp_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec
         },
+        {
+                .ctl_name       = NET_SCTP_SACK_TIMEOUT,
+                .procname       = "sack_timeout",
+                .data           = &sctp_sack_timeout,
+                .maxlen         = sizeof(long),
+                .mode           = 0644,
+                .proc_handler   = &proc_doulongvec_ms_jiffies_minmax,
+                .strategy       = &sctp_sysctl_jiffies_ms,
+                .extra1         = &sack_timer_min,
+                .extra2         = &sack_timer_max,
+        },
         { .ctl_name = 0 }
 };
 
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 0ec0fde6e6c5..d2f04ebe5081 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -57,7 +57,7 @@
 /* Initialize a new transport from provided memory.  */
 static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
                                                   const union sctp_addr *addr,
-                                                  int gfp)
+                                                  unsigned int __nocast gfp)
 {
         /* Copy in the address.  */
         peer->ipaddr = *addr;
@@ -103,7 +103,6 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
 
         /* Set up the heartbeat timer. */
         init_timer(&peer->hb_timer);
-        peer->hb_interval = SCTP_DEFAULT_TIMEOUT_HEARTBEAT;
         peer->hb_timer.function = sctp_generate_heartbeat_event;
         peer->hb_timer.data = (unsigned long)peer;
 
@@ -122,7 +121,8 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
 }
 
 /* Allocate and initialize a new transport.  */
-struct sctp_transport *sctp_transport_new(const union sctp_addr *addr, int gfp)
+struct sctp_transport *sctp_transport_new(const union sctp_addr *addr,
+                                          unsigned int __nocast gfp)
 {
         struct sctp_transport *transport;
 
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 17d0ff534735..0abd5101107c 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -74,7 +74,7 @@ SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event, int msg_flags)
 
 /* Create a new sctp_ulpevent.  */
 SCTP_STATIC struct sctp_ulpevent *sctp_ulpevent_new(int size, int msg_flags,
-                                                    int gfp)
+                                                    unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sk_buff *skb;
@@ -136,7 +136,7 @@ static inline void sctp_ulpevent_release_owner(struct sctp_ulpevent *event)
 struct sctp_ulpevent  *sctp_ulpevent_make_assoc_change(
         const struct sctp_association *asoc,
         __u16 flags, __u16 state, __u16 error, __u16 outbound,
-        __u16 inbound, int gfp)
+        __u16 inbound, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_assoc_change *sac;
@@ -237,7 +237,7 @@ fail:
 struct sctp_ulpevent *sctp_ulpevent_make_peer_addr_change(
         const struct sctp_association *asoc,
         const struct sockaddr_storage *aaddr,
-        int flags, int state, int error, int gfp)
+        int flags, int state, int error, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_paddr_change  *spc;
@@ -350,7 +350,7 @@ fail:
  */
 struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
         const struct sctp_association *asoc, struct sctp_chunk *chunk,
-        __u16 flags, int gfp)
+        __u16 flags, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_remote_error *sre;
@@ -448,7 +448,7 @@ fail:
  */
 struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
         const struct sctp_association *asoc, struct sctp_chunk *chunk,
-        __u16 flags, __u32 error, int gfp)
+        __u16 flags, __u32 error, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_send_failed *ssf;
@@ -557,7 +557,7 @@ fail:
  */
 struct sctp_ulpevent *sctp_ulpevent_make_shutdown_event(
         const struct sctp_association *asoc,
-        __u16 flags, int gfp)
+        __u16 flags, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_shutdown_event *sse;
@@ -620,7 +620,7 @@ fail:
  * 5.3.1.6 SCTP_ADAPTION_INDICATION
  */
 struct sctp_ulpevent *sctp_ulpevent_make_adaption_indication(
-        const struct sctp_association *asoc, int gfp)
+        const struct sctp_association *asoc, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_adaption_event *sai;
@@ -657,7 +657,7 @@ fail:
  */
 struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
                                                 struct sctp_chunk *chunk,
-                                                int gfp)
+                                                unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event = NULL;
         struct sk_buff *skb;
@@ -718,7 +718,8 @@ fail:
  *   various events.
  */
 struct sctp_ulpevent *sctp_ulpevent_make_pdapi(
-        const struct sctp_association *asoc, __u32 indication, int gfp)
+        const struct sctp_association *asoc, __u32 indication,
+        unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_pdapi_event *pd;
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index d5dd2cf7ac4a..8bbc279d6c99 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -100,7 +100,7 @@ void sctp_ulpq_free(struct sctp_ulpq *ulpq)
 
 /* Process an incoming DATA chunk.  */
 int sctp_ulpq_tail_data(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
-                        int gfp)
+                        unsigned int __nocast gfp)
 {
         struct sk_buff_head temp;
         sctp_data_chunk_t *hdr;
@@ -778,7 +778,8 @@ static __u16 sctp_ulpq_renege_frags(struct sctp_ulpq *ulpq, __u16 needed)
 
 /* Partial deliver the first message as there is pressure on rwnd. */
 void sctp_ulpq_partial_delivery(struct sctp_ulpq *ulpq,
-                                struct sctp_chunk *chunk, int gfp)
+                                struct sctp_chunk *chunk,
+                                unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_association *asoc;
@@ -802,7 +803,7 @@ void sctp_ulpq_partial_delivery(struct sctp_ulpq *ulpq,
 
 /* Renege some packets to make room for an incoming chunk.  */
 void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
-                      int gfp)
+                      unsigned int __nocast gfp)
 {
         struct sctp_association *asoc;
         __u16 needed, freed;
@@ -841,7 +842,7 @@ void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
 /* Notify the application if an association is aborted and in
  * partial delivery mode.  Send up any pending received messages.
  */
-void sctp_ulpq_abort_pd(struct sctp_ulpq *ulpq, int gfp)
+void sctp_ulpq_abort_pd(struct sctp_ulpq *ulpq, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *ev = NULL;
         struct sock *sk;