[SCTP] Bug fix for bind_bucket leak & heartbeat error count.

Off by one error causes us to think that there was an error one the first 
heartbeat timeout.  Also, fix leak in bind_buckets. 

include/net/sctp/sctp.h

@@ -275,6 +275,7 @@ extern atomic_t sctp_dbg_objcnt_assoc;
 extern atomic_t sctp_dbg_objcnt_transport;
 extern atomic_t sctp_dbg_objcnt_chunk;
 extern atomic_t sctp_dbg_objcnt_bind_addr;
+extern atomic_t sctp_dbg_objcnt_bind_bucket;
 extern atomic_t sctp_dbg_objcnt_addr;
 extern atomic_t sctp_dbg_objcnt_ssnmap;
 extern atomic_t sctp_dbg_objcnt_datamsg;

net/sctp/endpointola.c

@@ -209,7 +209,7 @@ void sctp_endpoint_destroy(struct sctp_endpoint *ep)
 	sctp_bind_addr_free(&ep->base.bind_addr);
 
 	/* Remove and free the port */
-	if (ep->base.sk->prev != NULL)
+	if (ep->base.sk->prev)
 		sctp_put_port(ep->base.sk);
 
 	/* Give up our hold on the sock. */

net/sctp/objcnt.c

@@ -52,6 +52,7 @@ SCTP_DBG_OBJCNT(ep);
 SCTP_DBG_OBJCNT(transport);
 SCTP_DBG_OBJCNT(assoc);
 SCTP_DBG_OBJCNT(bind_addr);
+SCTP_DBG_OBJCNT(bind_bucket);
 SCTP_DBG_OBJCNT(chunk);
 SCTP_DBG_OBJCNT(addr);
 SCTP_DBG_OBJCNT(ssnmap);
@@ -67,6 +68,7 @@ sctp_dbg_objcnt_entry_t sctp_dbg_objcnt[] = {
 	SCTP_DBG_OBJCNT_ENTRY(transport),
 	SCTP_DBG_OBJCNT_ENTRY(chunk),
 	SCTP_DBG_OBJCNT_ENTRY(bind_addr),
+	SCTP_DBG_OBJCNT_ENTRY(bind_bucket),
 	SCTP_DBG_OBJCNT_ENTRY(addr),
 	SCTP_DBG_OBJCNT_ENTRY(ssnmap),
 	SCTP_DBG_OBJCNT_ENTRY(datamsg),

net/sctp/sm_statefuns.c

@@ -737,7 +737,7 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
 {
 	struct sctp_transport *transport = (struct sctp_transport *) arg;
 
-	if (asoc->overall_error_count >= asoc->overall_error_threshold) {
+	if (asoc->overall_error_count > asoc->overall_error_threshold) {
 		/* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
 		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
 				SCTP_U32(SCTP_ERROR_NO_ERROR));

net/sctp/socket.c

@@ -3114,6 +3114,7 @@ static struct sctp_bind_bucket *sctp_bucket_create(
 	struct sctp_bind_bucket *pp;
 
 	pp = kmem_cache_alloc(sctp_bucket_cachep, SLAB_ATOMIC);
+	SCTP_DBG_OBJCNT_INC(bind_bucket);
 	if (pp) {
 		pp->port = snum;
 		pp->fastreuse = 0;
@@ -3129,11 +3130,12 @@ static struct sctp_bind_bucket *sctp_bucket_create(
 /* Caller must hold hashbucket lock for this tb with local BH disabled */
 static void sctp_bucket_destroy(struct sctp_bind_bucket *pp)
 {
-	if (pp->sk) {
+	if (!pp->sk) {
 		if (pp->next)
 			pp->next->pprev = pp->pprev;
 		*(pp->pprev) = pp->next;
 		kmem_cache_free(sctp_bucket_cachep, pp);
+		SCTP_DBG_OBJCNT_DEC(bind_bucket);
 	}
 }