5 files changed, 25 insertions, 39 deletions

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index df4854cf598b..8d1d7a6e72a5 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -236,7 +236,7 @@ unsigned int arpt_do_table(struct sk_buff **pskb,
         struct arpt_entry *e, *back;
         const char *indev, *outdev;
         void *table_base;
-        struct xt_table_info *private = table->private;
+        struct xt_table_info *private;
 
         /* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
         if (!pskb_may_pull((*pskb), (sizeof(struct arphdr) +
@@ -248,6 +248,7 @@ unsigned int arpt_do_table(struct sk_buff **pskb,
         outdev = out ? out->name : nulldevname;
 
         read_lock_bh(&table->lock);
+        private = table->private;
         table_base = (void *)private->entries[smp_processor_id()];
         e = get_entry(table_base, private->hook_entry[hook]);
         back = get_entry(table_base, private->underflow[hook]);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 507adefbc17c..b4f3ffe1b3b4 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -201,6 +201,7 @@ void tcp_select_initial_window(int __space, __u32 mss,
                  * See RFC1323 for an explanation of the limit to 14 
                  */
                 space = max_t(u32, sysctl_tcp_rmem[2], sysctl_rmem_max);
+                space = min_t(u32, space, *window_clamp);
                 while (space > 65535 && (*rcv_wscale) < 14) {
                         space >>= 1;
                         (*rcv_wscale)++;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 4f11f5858209..17b509282cf2 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -806,38 +806,26 @@ no_mem:
 
 /* Helper to create ABORT with a SCTP_ERROR_USER_ABORT error.  */
 struct sctp_chunk *sctp_make_abort_user(const struct sctp_association *asoc,
-                                   const struct sctp_chunk *chunk,
-                                   const struct msghdr *msg)
+                                        const struct msghdr *msg,
+                                        size_t paylen)
 {
         struct sctp_chunk *retval;
-        void *payload = NULL, *payoff;
-        size_t paylen = 0;
-        struct iovec *iov = NULL;
-        int iovlen = 0;
-
-        if (msg) {
-                iov = msg->msg_iov;
-                iovlen = msg->msg_iovlen;
-                paylen = get_user_iov_size(iov, iovlen);
-        }
+        void *payload = NULL;
+        int err;
 
-        retval = sctp_make_abort(asoc, chunk, sizeof(sctp_errhdr_t) + paylen);
+        retval = sctp_make_abort(asoc, NULL, sizeof(sctp_errhdr_t) + paylen);
         if (!retval)
                 goto err_chunk;
 
         if (paylen) {
                 /* Put the msg_iov together into payload.  */
-                payload = kmalloc(paylen, GFP_ATOMIC);
+                payload = kmalloc(paylen, GFP_KERNEL);
                 if (!payload)
                         goto err_payload;
-                payoff = payload;
 
-                for (; iovlen > 0; --iovlen) {
-                        if (copy_from_user(payoff, iov->iov_base,iov->iov_len))
-                                goto err_copy;
-                        payoff += iov->iov_len;
-                        iov++;
-                }
+                err = memcpy_fromiovec(payload, msg->msg_iov, paylen);
+                if (err < 0)
+                        goto err_copy;
         }
 
         sctp_init_cause(retval, SCTP_ERROR_USER_ABORT, payload, paylen);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index ead3f1b0ea3d..5b5ae7958322 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -4031,18 +4031,12 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(
          * from its upper layer, but retransmits data to the far end
          * if necessary to fill gaps.
          */
-        struct msghdr *msg = arg;
-        struct sctp_chunk *abort;
+        struct sctp_chunk *abort = arg;
         sctp_disposition_t retval;
 
         retval = SCTP_DISPOSITION_CONSUME;
 
-        /* Generate ABORT chunk to send the peer.  */
-        abort = sctp_make_abort_user(asoc, NULL, msg);
-        if (!abort)
-                retval = SCTP_DISPOSITION_NOMEM;
-        else
-                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
 
         /* Even if we can't send the ABORT due to low memory delete the
          * TCB.  This is a departure from our typical NOMEM handling.
@@ -4166,8 +4160,7 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
         void *arg,
         sctp_cmd_seq_t *commands)
 {
-        struct msghdr *msg = arg;
-        struct sctp_chunk *abort;
+        struct sctp_chunk *abort = arg;
         sctp_disposition_t retval;
 
         /* Stop T1-init timer */
@@ -4175,12 +4168,7 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
         retval = SCTP_DISPOSITION_CONSUME;
 
-        /* Generate ABORT chunk to send the peer */
-        abort = sctp_make_abort_user(asoc, NULL, msg);
-        if (!abort)
-                retval = SCTP_DISPOSITION_NOMEM;
-        else
-                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
 
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_CLOSED));
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 54722e622e6d..fde3f55bfd4b 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1520,8 +1520,16 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                         goto out_unlock;
                 }
                 if (sinfo_flags & SCTP_ABORT) {
+                        struct sctp_chunk *chunk;
+
+                        chunk = sctp_make_abort_user(asoc, msg, msg_len);
+                        if (!chunk) {
+                                err = -ENOMEM;
+                                goto out_unlock;
+                        }
+
                         SCTP_DEBUG_PRINTK("Aborting association: %p\n", asoc);
-                        sctp_primitive_ABORT(asoc, msg);
+                        sctp_primitive_ABORT(asoc, chunk);
                         err = 0;
                         goto out_unlock;
                 }