Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-5.4/0154-5.4.55-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-5.4/0154-5.4.55-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3554 - (hide annotations) (download)
    Tue Aug 4 14:58:22 2020 UTC (3 years, 10 months ago) by niro
    File size: 17779 byte(s) 
    -linux-5.4.55
    1 niro 3554 diff --git a/Makefile b/Makefile
    2     index ea711f30de29..072fe0eaa740 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,7 +1,7 @@
    6     # SPDX-License-Identifier: GPL-2.0
    7     VERSION = 5
    8     PATCHLEVEL = 4
    9     -SUBLEVEL = 54
    10     +SUBLEVEL = 55
    11     EXTRAVERSION =
    12     NAME = Kleptomaniac Octopus
    13    
    14     diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
    15     index 0bd9b291bb29..92f0960e9014 100644
    16     --- a/drivers/base/power/wakeup.c
    17     +++ b/drivers/base/power/wakeup.c
    18     @@ -1073,6 +1073,9 @@ static void *wakeup_sources_stats_seq_next(struct seq_file *m,
    19     break;
    20     }
    21    
    22     + if (!next_ws)
    23     + print_wakeup_source_stats(m, &deleted_ws);
    24     +
    25     return next_ws;
    26     }
    27    
    28     diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
    29     index e16afa27700d..f58baff2be0a 100644
    30     --- a/drivers/base/regmap/regmap-debugfs.c
    31     +++ b/drivers/base/regmap/regmap-debugfs.c
    32     @@ -227,6 +227,9 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from,
    33     if (*ppos < 0 || !count)
    34     return -EINVAL;
    35    
    36     + if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
    37     + count = PAGE_SIZE << (MAX_ORDER - 1);
    38     +
    39     buf = kmalloc(count, GFP_KERNEL);
    40     if (!buf)
    41     return -ENOMEM;
    42     @@ -371,6 +374,9 @@ static ssize_t regmap_reg_ranges_read_file(struct file *file,
    43     if (*ppos < 0 || !count)
    44     return -EINVAL;
    45    
    46     + if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
    47     + count = PAGE_SIZE << (MAX_ORDER - 1);
    48     +
    49     buf = kmalloc(count, GFP_KERNEL);
    50     if (!buf)
    51     return -ENOMEM;
    52     diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
    53     index cd9d08695cc1..00c4beb760c3 100644
    54     --- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
    55     +++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
    56     @@ -2802,7 +2802,7 @@ static int dpaa_eth_probe(struct platform_device *pdev)
    57     }
    58    
    59     /* Do this here, so we can be verbose early */
    60     - SET_NETDEV_DEV(net_dev, dev->parent);
    61     + SET_NETDEV_DEV(net_dev, dev);
    62     dev_set_drvdata(dev, net_dev);
    63    
    64     priv = netdev_priv(net_dev);
    65     diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
    66     index 914be5847386..cdcc380b4c26 100644
    67     --- a/drivers/net/wan/x25_asy.c
    68     +++ b/drivers/net/wan/x25_asy.c
    69     @@ -183,7 +183,7 @@ static inline void x25_asy_unlock(struct x25_asy *sl)
    70     netif_wake_queue(sl->dev);
    71     }
    72    
    73     -/* Send one completely decapsulated IP datagram to the IP layer. */
    74     +/* Send an LAPB frame to the LAPB module to process. */
    75    
    76     static void x25_asy_bump(struct x25_asy *sl)
    77     {
    78     @@ -195,13 +195,12 @@ static void x25_asy_bump(struct x25_asy *sl)
    79     count = sl->rcount;
    80     dev->stats.rx_bytes += count;
    81    
    82     - skb = dev_alloc_skb(count+1);
    83     + skb = dev_alloc_skb(count);
    84     if (skb == NULL) {
    85     netdev_warn(sl->dev, "memory squeeze, dropping packet\n");
    86     dev->stats.rx_dropped++;
    87     return;
    88     }
    89     - skb_push(skb, 1); /* LAPB internal control */
    90     skb_put_data(skb, sl->rbuff, count);
    91     skb->protocol = x25_type_trans(skb, sl->dev);
    92     err = lapb_data_received(skb->dev, skb);
    93     @@ -209,7 +208,6 @@ static void x25_asy_bump(struct x25_asy *sl)
    94     kfree_skb(skb);
    95     printk(KERN_DEBUG "x25_asy: data received err - %d\n", err);
    96     } else {
    97     - netif_rx(skb);
    98     dev->stats.rx_packets++;
    99     }
    100     }
    101     @@ -356,12 +354,21 @@ static netdev_tx_t x25_asy_xmit(struct sk_buff *skb,
    102     */
    103    
    104     /*
    105     - * Called when I frame data arrives. We did the work above - throw it
    106     - * at the net layer.
    107     + * Called when I frame data arrive. We add a pseudo header for upper
    108     + * layers and pass it to upper layers.
    109     */
    110    
    111     static int x25_asy_data_indication(struct net_device *dev, struct sk_buff *skb)
    112     {
    113     + if (skb_cow(skb, 1)) {
    114     + kfree_skb(skb);
    115     + return NET_RX_DROP;
    116     + }
    117     + skb_push(skb, 1);
    118     + skb->data[0] = X25_IFACE_DATA;
    119     +
    120     + skb->protocol = x25_type_trans(skb, dev);
    121     +
    122     return netif_rx(skb);
    123     }
    124    
    125     @@ -657,7 +664,7 @@ static void x25_asy_unesc(struct x25_asy *sl, unsigned char s)
    126     switch (s) {
    127     case X25_END:
    128     if (!test_and_clear_bit(SLF_ERROR, &sl->flags) &&
    129     - sl->rcount > 2)
    130     + sl->rcount >= 2)
    131     x25_asy_bump(sl);
    132     clear_bit(SLF_ESCAPE, &sl->flags);
    133     sl->rcount = 0;
    134     diff --git a/include/linux/tcp.h b/include/linux/tcp.h
    135     index 668e25a76d69..358deb4ff830 100644
    136     --- a/include/linux/tcp.h
    137     +++ b/include/linux/tcp.h
    138     @@ -216,6 +216,8 @@ struct tcp_sock {
    139     } rack;
    140     u16 advmss; /* Advertised MSS */
    141     u8 compressed_ack;
    142     + u8 tlp_retrans:1, /* TLP is a retransmission */
    143     + unused_1:7;
    144     u32 chrono_start; /* Start time in jiffies of a TCP chrono */
    145     u32 chrono_stat[3]; /* Time in jiffies for chrono_stat stats */
    146     u8 chrono_type:2, /* current chronograph type */
    147     @@ -238,7 +240,7 @@ struct tcp_sock {
    148     save_syn:1, /* Save headers of SYN packet */
    149     is_cwnd_limited:1,/* forward progress limited by snd_cwnd? */
    150     syn_smc:1; /* SYN includes SMC */
    151     - u32 tlp_high_seq; /* snd_nxt at the time of TLP retransmit. */
    152     + u32 tlp_high_seq; /* snd_nxt at the time of TLP */
    153    
    154     u32 tcp_tx_delay; /* delay (in usec) added to TX packets */
    155     u64 tcp_wstamp_ns; /* departure time for next sent data packet */
    156     diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
    157     index e5a3dc28116d..2fdb1b573e8c 100644
    158     --- a/net/ax25/af_ax25.c
    159     +++ b/net/ax25/af_ax25.c
    160     @@ -1187,7 +1187,10 @@ static int __must_check ax25_connect(struct socket *sock,
    161     if (addr_len > sizeof(struct sockaddr_ax25) &&
    162     fsa->fsa_ax25.sax25_ndigis != 0) {
    163     /* Valid number of digipeaters ? */
    164     - if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) {
    165     + if (fsa->fsa_ax25.sax25_ndigis < 1 ||
    166     + fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS ||
    167     + addr_len < sizeof(struct sockaddr_ax25) +
    168     + sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) {
    169     err = -EINVAL;
    170     goto out_release;
    171     }
    172     @@ -1507,7 +1510,10 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
    173     struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax;
    174    
    175     /* Valid number of digipeaters ? */
    176     - if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) {
    177     + if (usax->sax25_ndigis < 1 ||
    178     + usax->sax25_ndigis > AX25_MAX_DIGIS ||
    179     + addr_len < sizeof(struct sockaddr_ax25) +
    180     + sizeof(ax25_address) * usax->sax25_ndigis) {
    181     err = -EINVAL;
    182     goto out;
    183     }
    184     diff --git a/net/core/dev.c b/net/core/dev.c
    185     index 727965565d31..25858f1f67cf 100644
    186     --- a/net/core/dev.c
    187     +++ b/net/core/dev.c
    188     @@ -5229,7 +5229,7 @@ static void flush_backlog(struct work_struct *work)
    189     skb_queue_walk_safe(&sd->input_pkt_queue, skb, tmp) {
    190     if (skb->dev->reg_state == NETREG_UNREGISTERING) {
    191     __skb_unlink(skb, &sd->input_pkt_queue);
    192     - kfree_skb(skb);
    193     + dev_kfree_skb_irq(skb);
    194     input_queue_head_incr(sd);
    195     }
    196     }
    197     diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
    198     index 4c826b8bf9b1..2ebf9b252779 100644
    199     --- a/net/core/net-sysfs.c
    200     +++ b/net/core/net-sysfs.c
    201     @@ -1036,7 +1036,7 @@ static ssize_t tx_timeout_show(struct netdev_queue *queue, char *buf)
    202     trans_timeout = queue->trans_timeout;
    203     spin_unlock_irq(&queue->_xmit_lock);
    204    
    205     - return sprintf(buf, "%lu", trans_timeout);
    206     + return sprintf(buf, fmt_ulong, trans_timeout);
    207     }
    208    
    209     static unsigned int get_netdev_queue_index(struct netdev_queue *queue)
    210     diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    211     index 944acb1a9f29..b0c06a063776 100644
    212     --- a/net/core/rtnetlink.c
    213     +++ b/net/core/rtnetlink.c
    214     @@ -3231,7 +3231,8 @@ replay:
    215     */
    216     if (err < 0) {
    217     /* If device is not registered at all, free it now */
    218     - if (dev->reg_state == NETREG_UNINITIALIZED)
    219     + if (dev->reg_state == NETREG_UNINITIALIZED ||
    220     + dev->reg_state == NETREG_UNREGISTERED)
    221     free_netdev(dev);
    222     goto out;
    223     }
    224     diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
    225     index f3ceec93f392..40829111fe00 100644
    226     --- a/net/core/sock_reuseport.c
    227     +++ b/net/core/sock_reuseport.c
    228     @@ -112,6 +112,7 @@ static struct sock_reuseport *reuseport_grow(struct sock_reuseport *reuse)
    229     more_reuse->prog = reuse->prog;
    230     more_reuse->reuseport_id = reuse->reuseport_id;
    231     more_reuse->bind_inany = reuse->bind_inany;
    232     + more_reuse->has_conns = reuse->has_conns;
    233    
    234     memcpy(more_reuse->socks, reuse->socks,
    235     reuse->num_socks * sizeof(struct sock *));
    236     diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    237     index 6d331307beca..5040f7ca37ec 100644
    238     --- a/net/ipv4/tcp_input.c
    239     +++ b/net/ipv4/tcp_input.c
    240     @@ -3505,10 +3505,8 @@ static void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq)
    241     }
    242     }
    243    
    244     -/* This routine deals with acks during a TLP episode.
    245     - * We mark the end of a TLP episode on receiving TLP dupack or when
    246     - * ack is after tlp_high_seq.
    247     - * Ref: loss detection algorithm in draft-dukkipati-tcpm-tcp-loss-probe.
    248     +/* This routine deals with acks during a TLP episode and ends an episode by
    249     + * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack
    250     */
    251     static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
    252     {
    253     @@ -3517,7 +3515,10 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
    254     if (before(ack, tp->tlp_high_seq))
    255     return;
    256    
    257     - if (flag & FLAG_DSACKING_ACK) {
    258     + if (!tp->tlp_retrans) {
    259     + /* TLP of new data has been acknowledged */
    260     + tp->tlp_high_seq = 0;
    261     + } else if (flag & FLAG_DSACKING_ACK) {
    262     /* This DSACK means original and TLP probe arrived; no loss */
    263     tp->tlp_high_seq = 0;
    264     } else if (after(ack, tp->tlp_high_seq)) {
    265     diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    266     index 5dc7485c4076..4407193bd702 100644
    267     --- a/net/ipv4/tcp_output.c
    268     +++ b/net/ipv4/tcp_output.c
    269     @@ -2564,6 +2564,11 @@ void tcp_send_loss_probe(struct sock *sk)
    270     int pcount;
    271     int mss = tcp_current_mss(sk);
    272    
    273     + /* At most one outstanding TLP */
    274     + if (tp->tlp_high_seq)
    275     + goto rearm_timer;
    276     +
    277     + tp->tlp_retrans = 0;
    278     skb = tcp_send_head(sk);
    279     if (skb && tcp_snd_wnd_test(tp, skb, mss)) {
    280     pcount = tp->packets_out;
    281     @@ -2581,10 +2586,6 @@ void tcp_send_loss_probe(struct sock *sk)
    282     return;
    283     }
    284    
    285     - /* At most one outstanding TLP retransmission. */
    286     - if (tp->tlp_high_seq)
    287     - goto rearm_timer;
    288     -
    289     if (skb_still_in_host_queue(sk, skb))
    290     goto rearm_timer;
    291    
    292     @@ -2606,10 +2607,12 @@ void tcp_send_loss_probe(struct sock *sk)
    293     if (__tcp_retransmit_skb(sk, skb, 1))
    294     goto rearm_timer;
    295    
    296     + tp->tlp_retrans = 1;
    297     +
    298     +probe_sent:
    299     /* Record snd_nxt for loss detection. */
    300     tp->tlp_high_seq = tp->snd_nxt;
    301    
    302     -probe_sent:
    303     NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPLOSSPROBES);
    304     /* Reset s.t. tcp_rearm_rto will restart timer from now */
    305     inet_csk(sk)->icsk_pending = 0;
    306     diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    307     index f3b7cb725c1b..5d016bbdf16e 100644
    308     --- a/net/ipv4/udp.c
    309     +++ b/net/ipv4/udp.c
    310     @@ -413,7 +413,7 @@ static struct sock *udp4_lib_lookup2(struct net *net,
    311     struct udp_hslot *hslot2,
    312     struct sk_buff *skb)
    313     {
    314     - struct sock *sk, *result;
    315     + struct sock *sk, *result, *reuseport_result;
    316     int score, badness;
    317     u32 hash = 0;
    318    
    319     @@ -423,17 +423,20 @@ static struct sock *udp4_lib_lookup2(struct net *net,
    320     score = compute_score(sk, net, saddr, sport,
    321     daddr, hnum, dif, sdif);
    322     if (score > badness) {
    323     + reuseport_result = NULL;
    324     +
    325     if (sk->sk_reuseport &&
    326     sk->sk_state != TCP_ESTABLISHED) {
    327     hash = udp_ehashfn(net, daddr, hnum,
    328     saddr, sport);
    329     - result = reuseport_select_sock(sk, hash, skb,
    330     - sizeof(struct udphdr));
    331     - if (result && !reuseport_has_conns(sk, false))
    332     - return result;
    333     + reuseport_result = reuseport_select_sock(sk, hash, skb,
    334     + sizeof(struct udphdr));
    335     + if (reuseport_result && !reuseport_has_conns(sk, false))
    336     + return reuseport_result;
    337     }
    338     +
    339     + result = reuseport_result ? : sk;
    340     badness = score;
    341     - result = sk;
    342     }
    343     }
    344     return result;
    345     @@ -2045,7 +2048,7 @@ static int udp_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb)
    346     /*
    347     * UDP-Lite specific tests, ignored on UDP sockets
    348     */
    349     - if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
    350     + if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
    351    
    352     /*
    353     * MIB statistics other than incrementing the error count are
    354     diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
    355     index 04d76f043e18..44876509d215 100644
    356     --- a/net/ipv6/ip6_gre.c
    357     +++ b/net/ipv6/ip6_gre.c
    358     @@ -1560,17 +1560,18 @@ static void ip6gre_destroy_tunnels(struct net *net, struct list_head *head)
    359     static int __net_init ip6gre_init_net(struct net *net)
    360     {
    361     struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
    362     + struct net_device *ndev;
    363     int err;
    364    
    365     if (!net_has_fallback_tunnels(net))
    366     return 0;
    367     - ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
    368     - NET_NAME_UNKNOWN,
    369     - ip6gre_tunnel_setup);
    370     - if (!ign->fb_tunnel_dev) {
    371     + ndev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
    372     + NET_NAME_UNKNOWN, ip6gre_tunnel_setup);
    373     + if (!ndev) {
    374     err = -ENOMEM;
    375     goto err_alloc_dev;
    376     }
    377     + ign->fb_tunnel_dev = ndev;
    378     dev_net_set(ign->fb_tunnel_dev, net);
    379     /* FB netdevice is special: we have one, and only one per netns.
    380     * Allowing to move it to another netns is clearly unsafe.
    381     @@ -1590,7 +1591,7 @@ static int __net_init ip6gre_init_net(struct net *net)
    382     return 0;
    383    
    384     err_reg_dev:
    385     - free_netdev(ign->fb_tunnel_dev);
    386     + free_netdev(ndev);
    387     err_alloc_dev:
    388     return err;
    389     }
    390     diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
    391     index 9fec580c968e..6762430280f5 100644
    392     --- a/net/ipv6/udp.c
    393     +++ b/net/ipv6/udp.c
    394     @@ -148,7 +148,7 @@ static struct sock *udp6_lib_lookup2(struct net *net,
    395     int dif, int sdif, struct udp_hslot *hslot2,
    396     struct sk_buff *skb)
    397     {
    398     - struct sock *sk, *result;
    399     + struct sock *sk, *result, *reuseport_result;
    400     int score, badness;
    401     u32 hash = 0;
    402    
    403     @@ -158,17 +158,20 @@ static struct sock *udp6_lib_lookup2(struct net *net,
    404     score = compute_score(sk, net, saddr, sport,
    405     daddr, hnum, dif, sdif);
    406     if (score > badness) {
    407     + reuseport_result = NULL;
    408     +
    409     if (sk->sk_reuseport &&
    410     sk->sk_state != TCP_ESTABLISHED) {
    411     hash = udp6_ehashfn(net, daddr, hnum,
    412     saddr, sport);
    413    
    414     - result = reuseport_select_sock(sk, hash, skb,
    415     - sizeof(struct udphdr));
    416     - if (result && !reuseport_has_conns(sk, false))
    417     - return result;
    418     + reuseport_result = reuseport_select_sock(sk, hash, skb,
    419     + sizeof(struct udphdr));
    420     + if (reuseport_result && !reuseport_has_conns(sk, false))
    421     + return reuseport_result;
    422     }
    423     - result = sk;
    424     +
    425     + result = reuseport_result ? : sk;
    426     badness = score;
    427     }
    428     }
    429     @@ -643,7 +646,7 @@ static int udpv6_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb)
    430     /*
    431     * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c).
    432     */
    433     - if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
    434     + if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
    435    
    436     if (up->pcrlen == 0) { /* full coverage was set */
    437     net_dbg_ratelimited("UDPLITE6: partial coverage %d while full coverage %d requested\n",
    438     diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
    439     index 14c101e104ce..1ce1e710d025 100644
    440     --- a/net/qrtr/qrtr.c
    441     +++ b/net/qrtr/qrtr.c
    442     @@ -1004,6 +1004,7 @@ static int qrtr_release(struct socket *sock)
    443     sk->sk_state_change(sk);
    444    
    445     sock_set_flag(sk, SOCK_DEAD);
    446     + sock_orphan(sk);
    447     sock->sk = NULL;
    448    
    449     if (!sock_flag(sk, SOCK_ZAPPED))
    450     diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
    451     index 8578c39ec839..6896a33ef842 100644
    452     --- a/net/rxrpc/recvmsg.c
    453     +++ b/net/rxrpc/recvmsg.c
    454     @@ -464,7 +464,7 @@ try_again:
    455     list_empty(&rx->recvmsg_q) &&
    456     rx->sk.sk_state != RXRPC_SERVER_LISTENING) {
    457     release_sock(&rx->sk);
    458     - return -ENODATA;
    459     + return -EAGAIN;
    460     }
    461    
    462     if (list_empty(&rx->recvmsg_q)) {
    463     diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
    464     index 5e9c43d4a314..49d03c8c64da 100644
    465     --- a/net/rxrpc/sendmsg.c
    466     +++ b/net/rxrpc/sendmsg.c
    467     @@ -306,7 +306,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
    468     /* this should be in poll */
    469     sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
    470    
    471     - if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
    472     + if (sk->sk_shutdown & SEND_SHUTDOWN)
    473     return -EPIPE;
    474    
    475     more = msg->msg_flags & MSG_MORE;
    476     diff --git a/net/sctp/stream.c b/net/sctp/stream.c
    477     index c1a100d2fed3..e13cbd5c0193 100644
    478     --- a/net/sctp/stream.c
    479     +++ b/net/sctp/stream.c
    480     @@ -22,17 +22,11 @@
    481     #include <net/sctp/sm.h>
    482     #include <net/sctp/stream_sched.h>
    483    
    484     -/* Migrates chunks from stream queues to new stream queues if needed,
    485     - * but not across associations. Also, removes those chunks to streams
    486     - * higher than the new max.
    487     - */
    488     -static void sctp_stream_outq_migrate(struct sctp_stream *stream,
    489     - struct sctp_stream *new, __u16 outcnt)
    490     +static void sctp_stream_shrink_out(struct sctp_stream *stream, __u16 outcnt)
    491     {
    492     struct sctp_association *asoc;
    493     struct sctp_chunk *ch, *temp;
    494     struct sctp_outq *outq;
    495     - int i;
    496    
    497     asoc = container_of(stream, struct sctp_association, stream);
    498     outq = &asoc->outqueue;
    499     @@ -56,6 +50,19 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream,
    500    
    501     sctp_chunk_free(ch);
    502     }
    503     +}
    504     +
    505     +/* Migrates chunks from stream queues to new stream queues if needed,
    506     + * but not across associations. Also, removes those chunks to streams
    507     + * higher than the new max.
    508     + */
    509     +static void sctp_stream_outq_migrate(struct sctp_stream *stream,
    510     + struct sctp_stream *new, __u16 outcnt)
    511     +{
    512     + int i;
    513     +
    514     + if (stream->outcnt > outcnt)
    515     + sctp_stream_shrink_out(stream, outcnt);
    516    
    517     if (new) {
    518     /* Here we actually move the old ext stuff into the new
    519     @@ -1038,11 +1045,13 @@ struct sctp_chunk *sctp_process_strreset_resp(
    520     nums = ntohs(addstrm->number_of_streams);
    521     number = stream->outcnt - nums;
    522    
    523     - if (result == SCTP_STRRESET_PERFORMED)
    524     + if (result == SCTP_STRRESET_PERFORMED) {
    525     for (i = number; i < stream->outcnt; i++)
    526     SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN;
    527     - else
    528     + } else {
    529     + sctp_stream_shrink_out(stream, number);
    530     stream->outcnt = number;
    531     + }
    532    
    533     *evp = sctp_ulpevent_make_stream_change_event(asoc, flags,
    534     0, nums, GFP_ATOMIC);