4 files changed, 24 insertions, 74 deletions

diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 5ae609200674..f558433537b8 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1367,44 +1367,35 @@ static inline bool sctp_peer_needs_update(struct sctp_association *asoc)
         return false;
 }
 
-/* Increase asoc's rwnd by len and send any window update SACK if needed. */
-void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
+/* Update asoc's rwnd for the approximated state in the buffer,
+ * and check whether SACK needs to be sent.
+ */
+void sctp_assoc_rwnd_update(struct sctp_association *asoc, bool update_peer)
 {
+        int rx_count;
         struct sctp_chunk *sack;
         struct timer_list *timer;
 
-        if (asoc->rwnd_over) {
-                if (asoc->rwnd_over >= len) {
-                        asoc->rwnd_over -= len;
-                } else {
-                        asoc->rwnd += (len - asoc->rwnd_over);
-                        asoc->rwnd_over = 0;
-                }
-        } else {
-                asoc->rwnd += len;
-        }
+        if (asoc->ep->rcvbuf_policy)
+                rx_count = atomic_read(&asoc->rmem_alloc);
+        else
+                rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
 
-        /* If we had window pressure, start recovering it
-         * once our rwnd had reached the accumulated pressure
-         * threshold.  The idea is to recover slowly, but up
-         * to the initial advertised window.
-         */
-        if (asoc->rwnd_press && asoc->rwnd >= asoc->rwnd_press) {
-                int change = min(asoc->pathmtu, asoc->rwnd_press);
-                asoc->rwnd += change;
-                asoc->rwnd_press -= change;
-        }
+        if ((asoc->base.sk->sk_rcvbuf - rx_count) > 0)
+                asoc->rwnd = (asoc->base.sk->sk_rcvbuf - rx_count) >> 1;
+        else
+                asoc->rwnd = 0;
 
-        pr_debug("%s: asoc:%p rwnd increased by %d to (%u, %u) - %u\n",
-                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
-                 asoc->a_rwnd);
+        pr_debug("%s: asoc:%p rwnd=%u, rx_count=%d, sk_rcvbuf=%d\n",
+                 __func__, asoc, asoc->rwnd, rx_count,
+                 asoc->base.sk->sk_rcvbuf);
 
         /* Send a window update SACK if the rwnd has increased by at least the
          * minimum of the association's PMTU and half of the receive buffer.
          * The algorithm used is similar to the one described in
          * Section 4.2.3.3 of RFC 1122.
          */
-        if (sctp_peer_needs_update(asoc)) {
+        if (update_peer && sctp_peer_needs_update(asoc)) {
                 asoc->a_rwnd = asoc->rwnd;
 
                 pr_debug("%s: sending window update SACK- asoc:%p rwnd:%u "
@@ -1426,45 +1417,6 @@ void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
         }
 }
 
-/* Decrease asoc's rwnd by len. */
-void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
-{
-        int rx_count;
-        int over = 0;
-
-        if (unlikely(!asoc->rwnd || asoc->rwnd_over))
-                pr_debug("%s: association:%p has asoc->rwnd:%u, "
-                         "asoc->rwnd_over:%u!\n", __func__, asoc,
-                         asoc->rwnd, asoc->rwnd_over);
-
-        if (asoc->ep->rcvbuf_policy)
-                rx_count = atomic_read(&asoc->rmem_alloc);
-        else
-                rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
-
-        /* If we've reached or overflowed our receive buffer, announce
-         * a 0 rwnd if rwnd would still be positive.  Store the
-         * the potential pressure overflow so that the window can be restored
-         * back to original value.
-         */
-        if (rx_count >= asoc->base.sk->sk_rcvbuf)
-                over = 1;
-
-        if (asoc->rwnd >= len) {
-                asoc->rwnd -= len;
-                if (over) {
-                        asoc->rwnd_press += asoc->rwnd;
-                        asoc->rwnd = 0;
-                }
-        } else {
-                asoc->rwnd_over = len - asoc->rwnd;
-                asoc->rwnd = 0;
-        }
-
-        pr_debug("%s: asoc:%p rwnd decreased by %d to (%u, %u, %u)\n",
-                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
-                 asoc->rwnd_press);
-}
 
 /* Build the bind address list for the association based on info from the
  * local endpoint and the remote peer.
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 483dcd71b3c5..591b44d3b7de 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -6176,7 +6176,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          * PMTU.  In cases, such as loopback, this might be a rather
          * large spill over.
          */
-        if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
+        if ((!chunk->data_accepted) && (!asoc->rwnd ||
             (datalen > asoc->rwnd + asoc->frag_point))) {
 
                 /* If this is the next TSN, consider reneging to make
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9e91d6e5df63..7075ac847fde 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2092,12 +2092,6 @@ static int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
                 sctp_skb_pull(skb, copied);
                 skb_queue_head(&sk->sk_receive_queue, skb);
 
-                /* When only partial message is copied to the user, increase
-                 * rwnd by that amount. If all the data in the skb is read,
-                 * rwnd is updated when the event is freed.
-                 */
-                if (!sctp_ulpevent_is_notification(event))
-                        sctp_assoc_rwnd_increase(event->asoc, copied);
                 goto out;
         } else if ((event->msg_flags & MSG_NOTIFICATION) ||
                    (event->msg_flags & MSG_EOR))
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 85c64658bd0b..8d198ae03606 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -989,7 +989,7 @@ static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
         skb = sctp_event2skb(event);
         /* Set the owner and charge rwnd for bytes received.  */
         sctp_ulpevent_set_owner(event, asoc);
-        sctp_assoc_rwnd_decrease(asoc, skb_headlen(skb));
+        sctp_assoc_rwnd_update(asoc, false);
 
         if (!skb->data_len)
                 return;
@@ -1011,6 +1011,7 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
 {
         struct sk_buff *skb, *frag;
         unsigned int    len;
+        struct sctp_association *asoc;
 
         /* Current stack structures assume that the rcv buffer is
          * per socket.   For UDP style sockets this is not true as
@@ -1035,8 +1036,11 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
         }
 
 done:
-        sctp_assoc_rwnd_increase(event->asoc, len);
+        asoc = event->asoc;
+        sctp_association_hold(asoc);
         sctp_ulpevent_release_owner(event);
+        sctp_assoc_rwnd_update(asoc, true);
+        sctp_association_put(asoc);
 }
 
 static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event)