3 files changed, 18 insertions, 5 deletions

diff --git a/net/sctp/input.c b/net/sctp/input.c
index bf612d954d41..2e4a8646dbc3 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -249,6 +249,19 @@ int sctp_rcv(struct sk_buff *skb)
          */
         sctp_bh_lock_sock(sk);
 
+        if (sk != rcvr->sk) {
+                /* Our cached sk is different from the rcvr->sk.  This is
+                 * because migrate()/accept() may have moved the association
+                 * to a new socket and released all the sockets.  So now we
+                 * are holding a lock on the old socket while the user may
+                 * be doing something with the new socket.  Switch our veiw
+                 * of the current sk.
+                 */
+                sctp_bh_unlock_sock(sk);
+                sk = rcvr->sk;
+                sctp_bh_lock_sock(sk);
+        }
+
         if (sock_owned_by_user(sk)) {
                 SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_BACKLOG);
                 sctp_add_backlog(sk, skb);
diff --git a/net/sctp/output.c b/net/sctp/output.c
index c3f417f7ec6e..73639355157e 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -324,14 +324,16 @@ append:
         switch (chunk->chunk_hdr->type) {
             case SCTP_CID_DATA:
                 retval = sctp_packet_append_data(packet, chunk);
+                if (SCTP_XMIT_OK != retval)
+                        goto finish;
                 /* Disallow SACK bundling after DATA. */
                 packet->has_sack = 1;
                 /* Disallow AUTH bundling after DATA */
                 packet->has_auth = 1;
                 /* Let it be knows that packet has DATA in it */
                 packet->has_data = 1;
-                if (SCTP_XMIT_OK != retval)
-                        goto finish;
+                /* timestamp the chunk for rtx purposes */
+                chunk->sent_at = jiffies;
                 break;
             case SCTP_CID_COOKIE_ECHO:
                 packet->has_cookie_echo = 1;
@@ -470,7 +472,6 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                         } else
                                 chunk->resent = 1;
 
-                        chunk->sent_at = jiffies;
                         has_data = 1;
                 }
 
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 247ebc95c1e5..bc411c896216 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -929,7 +929,6 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                 }
 
                 /* Finally, transmit new packets.  */
-                start_timer = 0;
                 while ((chunk = sctp_outq_dequeue_data(q)) != NULL) {
                         /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
                          * stream identifier.
@@ -1028,7 +1027,7 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                         list_add_tail(&chunk->transmitted_list,
                                       &transport->transmitted);
 
-                        sctp_transport_reset_timers(transport, start_timer-1);
+                        sctp_transport_reset_timers(transport, 0);
 
                         q->empty = 0;