This is from a first audit, more eyeballs are more than welcome.
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 static inline void dccp_update_gsr(struct sock *sk, u64 seq)
 {
        struct dccp_sock *dp = dccp_sk(sk);
-       u64 tmp_gsr;
 
-       dccp_set_seqno(&tmp_gsr,
+       dp->dccps_gsr = seq;
+       dccp_set_seqno(&dp->dccps_swl,
                       (dp->dccps_gsr + 1 -
                        (dp->dccps_options.dccpo_sequence_window / 4)));
-       dp->dccps_gsr = seq;
-       dccp_set_seqno(&dp->dccps_swl, max48(tmp_gsr, dp->dccps_isr));
        dccp_set_seqno(&dp->dccps_swh,
                       (dp->dccps_gsr +
                        (3 * dp->dccps_options.dccpo_sequence_window) / 4));
 static inline void dccp_update_gss(struct sock *sk, u64 seq)
 {
        struct dccp_sock *dp = dccp_sk(sk);
-       u64 tmp_gss;
 
-       dccp_set_seqno(&tmp_gss,
+       dp->dccps_awh = dp->dccps_gss = seq;
+       dccp_set_seqno(&dp->dccps_awl,
                       (dp->dccps_gss -
                        dp->dccps_options.dccpo_sequence_window + 1));
-       dp->dccps_awl = max48(tmp_gss, dp->dccps_iss);
-       dp->dccps_awh = dp->dccps_gss = seq;
 }
 
 extern void dccp_insert_options(struct sock *sk, struct sk_buff *skb);
 
                }
 
                dp->dccps_isr = DCCP_SKB_CB(skb)->dccpd_seq;
-               dccp_update_gsr(sk, DCCP_SKB_CB(skb)->dccpd_seq);
+               dccp_update_gsr(sk, dp->dccps_isr);
+               /*
+                * SWL and AWL are initially adjusted so that they are not less than
+                * the initial Sequence Numbers received and sent, respectively:
+                *      SWL := max(GSR + 1 - floor(W/4), ISR),
+                *      AWL := max(GSS - W' + 1, ISS).
+                * These adjustments MUST be applied only at the beginning of the
+                * connection.
+                *
+                * AWL was adjusted in dccp_v4_connect -acme
+                */
+               dccp_set_seqno(&dp->dccps_swl,
+                              max48(dp->dccps_swl, dp->dccps_isr));
 
                if (ccid_hc_rx_init(dp->dccps_hc_rx_ccid, sk) != 0 ||
                    ccid_hc_tx_init(dp->dccps_hc_tx_ccid, sk) != 0) {
 
                                                            usin->sin_port);
        dccp_update_gss(sk, dp->dccps_iss);
 
+       /*
+        * SWL and AWL are initially adjusted so that they are not less than
+        * the initial Sequence Numbers received and sent, respectively:
+        *      SWL := max(GSR + 1 - floor(W/4), ISR),
+        *      AWL := max(GSS - W' + 1, ISS).
+        * These adjustments MUST be applied only at the beginning of the
+        * connection.
+        */
+       dccp_set_seqno(&dp->dccps_awl, max48(dp->dccps_awl, dp->dccps_iss));
+
        inet->id = dp->dccps_iss ^ jiffies;
 
        err = dccp_connect(sk);
 
                newdp->dccps_iss = dreq->dreq_iss;
                dccp_update_gss(newsk, dreq->dreq_iss);
 
+               /*
+                * SWL and AWL are initially adjusted so that they are not less than
+                * the initial Sequence Numbers received and sent, respectively:
+                *      SWL := max(GSR + 1 - floor(W/4), ISR),
+                *      AWL := max(GSS - W' + 1, ISS).
+                * These adjustments MUST be applied only at the beginning of the
+                * connection.
+                */
+               dccp_set_seqno(&newdp->dccps_swl,
+                              max48(newdp->dccps_swl, newdp->dccps_isr));
+               dccp_set_seqno(&newdp->dccps_awl,
+                              max48(newdp->dccps_awl, newdp->dccps_iss));
+
                dccp_init_xmit_timers(newsk);
 
                DCCP_INC_STATS_BH(DCCP_MIB_PASSIVEOPENS);
 
        /*
         * sk->sk_send_head has to have one skb with
         * DCCP_SKB_CB(skb)->dccpd_type set to one of the retransmittable DCCP
-        * packet types (REQUEST, RESPONSE, the ACK in the 3way hanshake
+        * packet types (REQUEST, RESPONSE, the ACK in the 3way handshake
         * (PARTOPEN timer), etc).
         */
        BUG_TRAP(sk->sk_send_head != NULL);