4 files changed, 61 insertions, 13 deletions

diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 1c88c8911dc5..d03682109b7a 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -1582,6 +1582,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
 #endif /* SCTP_DEBUG */
         if (transport) {
                 if (bytes_acked) {
+                        struct sctp_association *asoc = transport->asoc;
+
                         /* We may have counted DATA that was migrated
                          * to this transport due to DEL-IP operation.
                          * Subtract those bytes, since the were never
@@ -1600,6 +1602,17 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                         transport->error_count = 0;
                         transport->asoc->overall_error_count = 0;
 
+                        /*
+                         * While in SHUTDOWN PENDING, we may have started
+                         * the T5 shutdown guard timer after reaching the
+                         * retransmission limit. Stop that timer as soon
+                         * as the receiver acknowledged any data.
+                         */
+                        if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING &&
+                            del_timer(&asoc->timers
+                                [SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD]))
+                                        sctp_association_put(asoc);
+
                         /* Mark the destination transport address as
                          * active if it is not so marked.
                          */
@@ -1629,10 +1642,15 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                          * A sender is doing zero window probing when the
                          * receiver's advertised window is zero, and there is
                          * only one data chunk in flight to the receiver.
+                         *
+                         * Allow the association to timeout while in SHUTDOWN
+                         * PENDING or SHUTDOWN RECEIVED in case the receiver
+                         * stays in zero window mode forever.
                          */
                         if (!q->asoc->peer.rwnd &&
                             !list_empty(&tlist) &&
-                            (sack_ctsn+2 == q->asoc->next_tsn)) {
+                            (sack_ctsn+2 == q->asoc->next_tsn) &&
+                            q->asoc->state < SCTP_STATE_SHUTDOWN_PENDING) {
                                 SCTP_DEBUG_PRINTK("%s: SACK received for zero "
                                                   "window probe: %u\n",
                                                   __func__, sack_ctsn);
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 534c2e5feb05..6e0f88295aaf 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -670,10 +670,19 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
         /* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of the
          * HEARTBEAT should clear the error counter of the destination
          * transport address to which the HEARTBEAT was sent.
-         * The association's overall error count is also cleared.
          */
         t->error_count = 0;
-        t->asoc->overall_error_count = 0;
+
+        /*
+         * Although RFC4960 specifies that the overall error count must
+         * be cleared when a HEARTBEAT ACK is received, we make an
+         * exception while in SHUTDOWN PENDING. If the peer keeps its
+         * window shut forever, we may never be able to transmit our
+         * outstanding data and rely on the retransmission limit be reached
+         * to shutdown the association.
+         */
+        if (t->asoc->state != SCTP_STATE_SHUTDOWN_PENDING)
+                t->asoc->overall_error_count = 0;
 
         /* Clear the hb_sent flag to signal that we had a good
          * acknowledgement.
@@ -1437,6 +1446,13 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                         sctp_cmd_setup_t2(commands, asoc, cmd->obj.ptr);
                         break;
 
+                case SCTP_CMD_TIMER_START_ONCE:
+                        timer = &asoc->timers[cmd->obj.to];
+
+                        if (timer_pending(timer))
+                                break;
+                        /* fall through */
+
                 case SCTP_CMD_TIMER_START:
                         timer = &asoc->timers[cmd->obj.to];
                         timeout = asoc->timeouts[cmd->obj.to];
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index a297283154d5..246117142b5c 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -5154,7 +5154,7 @@ sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
          * The sender of the SHUTDOWN MAY also start an overall guard timer
          * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
          */
-        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
+        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
 
         if (asoc->autoclose)
@@ -5299,14 +5299,28 @@ sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
         SCTP_INC_STATS(SCTP_MIB_T3_RTX_EXPIREDS);
 
         if (asoc->overall_error_count >= asoc->max_retrans) {
-                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
-                                SCTP_ERROR(ETIMEDOUT));
-                /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
-                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
-                                SCTP_PERR(SCTP_ERROR_NO_ERROR));
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
-                return SCTP_DISPOSITION_DELETE_TCB;
+                if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
+                        /*
+                         * We are here likely because the receiver had its rwnd
+                         * closed for a while and we have not been able to
+                         * transmit the locally queued data within the maximum
+                         * retransmission attempts limit.  Start the T5
+                         * shutdown guard timer to give the receiver one last
+                         * chance and some additional time to recover before
+                         * aborting.
+                         */
+                        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START_ONCE,
+                                SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
+                } else {
+                        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                        SCTP_ERROR(ETIMEDOUT));
+                        /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
+                        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
+                                        SCTP_PERR(SCTP_ERROR_NO_ERROR));
+                        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+                        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                        return SCTP_DISPOSITION_DELETE_TCB;
+                }
         }
 
         /* E1) For the destination address for which the timer
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 0338dc6fdc9d..7c211a7f90f4 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -827,7 +827,7 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
         /* SCTP_STATE_ESTABLISHED */ \
         TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
         /* SCTP_STATE_SHUTDOWN_PENDING */ \
-        TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
+        TYPE_SCTP_FUNC(sctp_sf_t5_timer_expire), \
         /* SCTP_STATE_SHUTDOWN_SENT */ \
         TYPE_SCTP_FUNC(sctp_sf_t5_timer_expire), \
         /* SCTP_STATE_SHUTDOWN_RECEIVED */ \