V4L/DVB (6784): tda8290: prevent possible memory leak

[safe/jmp/linux-2.6] / net / sctp / sm_statefuns.c

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 5aef4aa..d247ed4 100644 (file)
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -959,7 +959,7 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
 {
        struct sctp_transport *transport = (struct sctp_transport *) arg;
 
-       if (asoc->overall_error_count >= asoc->max_retrans) {
+       if (asoc->overall_error_count > asoc->max_retrans) {
                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
                                SCTP_ERROR(ETIMEDOUT));
                /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
@@ -1146,7 +1146,7 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
        /* Check if the timestamp looks valid.  */
        if (time_after(hbinfo->sent_at, jiffies) ||
            time_after(jiffies, hbinfo->sent_at + max_interval)) {
-               SCTP_DEBUG_PRINTK("%s: HEARTBEAT ACK with invalid timestamp"
+               SCTP_DEBUG_PRINTK("%s: HEARTBEAT ACK with invalid timestamp "
                                  "received for transport: %p\n",
                                   __FUNCTION__, link);
                return SCTP_DISPOSITION_DISCARD;
@@ -1309,26 +1309,6 @@ static void sctp_tietags_populate(struct sctp_association *new_asoc,
        new_asoc->c.initial_tsn         = asoc->c.initial_tsn;
 }
 
-static void sctp_auth_params_populate(struct sctp_association *new_asoc,
-                                   const struct sctp_association *asoc)
-{
-       /* Only perform this if AUTH extension is enabled */
-       if (!sctp_auth_enable)
-               return;
-
-       /* We need to provide the same parameter information as
-        * was in the original INIT.  This means that we need to copy
-        * the HMACS, CHUNKS, and RANDOM parameter from the original
-        * assocaition.
-        */
-       memcpy(new_asoc->c.auth_random, asoc->c.auth_random,
-               sizeof(asoc->c.auth_random));
-       memcpy(new_asoc->c.auth_hmacs, asoc->c.auth_hmacs,
-               sizeof(asoc->c.auth_hmacs));
-       memcpy(new_asoc->c.auth_chunks, asoc->c.auth_chunks,
-               sizeof(asoc->c.auth_chunks));
-}
-
 /*
  * Compare vtag/tietag values to determine unexpected COOKIE-ECHO
  * handling action.
@@ -1486,8 +1466,6 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
 
        sctp_tietags_populate(new_asoc, asoc);
 
-       sctp_auth_params_populate(new_asoc, asoc);
-
        /* B) "Z" shall respond immediately with an INIT ACK chunk.  */
 
        /* If there are errors need to be reported for unknown parameters,
@@ -2305,7 +2283,7 @@ static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
        /* If we've sent any data bundled with COOKIE-ECHO we will need to
         * resend
         */
-       sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN,
+       sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN,
                        SCTP_TRANSPORT(asoc->peer.primary_path));
 
        /* Cast away the const modifier, as we want to just
@@ -3848,6 +3826,19 @@ sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
                        break;
        }
 
+       if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
+               struct sctp_ulpevent *ev;
+
+               ev = sctp_ulpevent_make_authkey(asoc, ntohs(auth_hdr->shkey_id),
+                                   SCTP_AUTH_NEWKEY, GFP_ATOMIC);
+
+               if (!ev)
+                       return -ENOMEM;
+
+               sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
+                               SCTP_ULPEVENT(ev));
+       }
+
        return SCTP_DISPOSITION_CONSUME;
 }
 
@@ -4051,11 +4042,6 @@ static sctp_disposition_t sctp_sf_abort_violation(
        struct sctp_chunk *chunk =  arg;
        struct sctp_chunk *abort = NULL;
 
-       /* Make the abort chunk. */
-       abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
-       if (!abort)
-               goto nomem;
-
        /* SCTP-AUTH, Section 6.3:
         *    It should be noted that if the receiver wants to tear
         *    down an association in an authenticated way only, the
@@ -4070,6 +4056,11 @@ static sctp_disposition_t sctp_sf_abort_violation(
        if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
                goto discard;
 
+       /* Make the abort chunk. */
+       abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
+       if (!abort)
+               goto nomem;
+
        if (asoc) {
                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);