2 files changed, 16 insertions, 14 deletions

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 83a76ba9d7..4dcdabf564 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4164,6 +4164,7 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len,
         rwlock_t *addr_lock;
         int err = 0;
         void *addrs;
+        void *buf;
         int bytes_copied = 0;
 
         if (len != sizeof(struct sctp_getaddrs_old))
@@ -4217,13 +4218,14 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len,
                 }
         }
 
+        buf = addrs;
         list_for_each(pos, &bp->address_list) {
                 addr = list_entry(pos, struct sctp_sockaddr_entry, list);
                 memcpy(&temp, &addr->a, sizeof(temp));
                 sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp, &temp);
                 addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
-                memcpy(addrs, &temp, addrlen);
-                to += addrlen;
+                memcpy(buf, &temp, addrlen);
+                buf += addrlen;
                 bytes_copied += addrlen;
                 cnt ++;
                 if (cnt >= getaddrs.addr_num) break;
@@ -4266,6 +4268,7 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
         size_t space_left;
         int bytes_copied = 0;
         void *addrs;
+        void *buf;
 
         if (len <= sizeof(struct sctp_getaddrs))
                 return -EINVAL;
@@ -4316,6 +4319,7 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
                 }
         }
 
+        buf = addrs;
         list_for_each(pos, &bp->address_list) {
                 addr = list_entry(pos, struct sctp_sockaddr_entry, list);
                 memcpy(&temp, &addr->a, sizeof(temp));
@@ -4325,8 +4329,8 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
                         err =  -ENOMEM; /*fixme: right error?*/
                         goto error;
                 }
-                memcpy(addrs, &temp, addrlen);
-                to += addrlen;
+                memcpy(buf, &temp, addrlen);
+                buf += addrlen;
                 bytes_copied += addrlen;
                 cnt ++;
                 space_left -= addrlen;
@@ -5227,7 +5231,12 @@ int sctp_inet_listen(struct socket *sock, int backlog)
         /* Allocate HMAC for generating cookie. */
         if (sctp_hmac_alg) {
                 tfm = crypto_alloc_hash(sctp_hmac_alg, 0, CRYPTO_ALG_ASYNC);
-                if (!tfm) {
+                if (IS_ERR(tfm)) {
+                        if (net_ratelimit()) {
+                                printk(KERN_INFO
+                                       "SCTP: failed to load transform for %s: %ld\n",
+                                        sctp_hmac_alg, PTR_ERR(tfm));
+                        }
                         err = -ENOSYS;
                         goto out;
                 }
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 661ea2dd78..bfecb353ab 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -141,11 +141,6 @@ struct sctp_ulpevent  *sctp_ulpevent_make_assoc_change(
          * an ABORT, so we need to include it in the sac_info.
          */
         if (chunk) {
-                /* sctp_inqu_pop() has allready pulled off the chunk
-                 * header.  We need to put it back temporarily
-                 */
-                skb_push(chunk->skb, sizeof(sctp_chunkhdr_t));
-
                 /* Copy the chunk data to a new skb and reserve enough
                  * head room to use as notification.
                  */
@@ -155,9 +150,6 @@ struct sctp_ulpevent  *sctp_ulpevent_make_assoc_change(
                 if (!skb)
                         goto fail;
 
-                /* put back the chunk header now that we have a copy */
-                skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t));
-
                 /* Embed the event fields inside the cloned skb.  */
                 event = sctp_skb2event(skb);
                 sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
@@ -168,7 +160,8 @@ struct sctp_ulpevent  *sctp_ulpevent_make_assoc_change(
 
                 /* Trim the buffer to the right length.  */
                 skb_trim(skb, sizeof(struct sctp_assoc_change) +
-                         ntohs(chunk->chunk_hdr->length));
+                         ntohs(chunk->chunk_hdr->length) -
+                         sizeof(sctp_chunkhdr_t));
         } else {
                 event = sctp_ulpevent_new(sizeof(struct sctp_assoc_change),
                                   MSG_NOTIFICATION, gfp);