| From foo@baz Mon Apr 9 17:09:24 CEST 2018 |
| From: Jag Raman <jag.raman@oracle.com> |
| Date: Fri, 9 Jun 2017 12:29:31 -0400 |
| Subject: sparc64: ldc abort during vds iso boot |
| |
| From: Jag Raman <jag.raman@oracle.com> |
| |
| |
| [ Upstream commit 6c95483b768c62f8ee933ae08a1bdbcb78b5410f ] |
| |
| Orabug: 20902628 |
| |
| When an ldc control-only packet is received during data exchange in |
| read_nonraw(), a new rx head is calculated but the rx queue head is not |
| actually advanced (rx_set_head() is not called) and a branch is taken to |
| 'no_data' at which point two things can happen depending on the value |
| of the newly calculated rx head and the current rx tail: |
| |
| - If the rx queue is determined to be not empty, then the wrong packet |
| is picked up. |
| |
| - If the rx queue is determined to be empty, then a read error (EAGAIN) |
| is eventually returned since it is falsely assumed that more data was |
| expected. |
| |
| The fix is to update the rx head and return in case of a control only |
| packet during data exchange. |
| |
| Signed-off-by: Jagannathan Raman <jag.raman@oracle.com> |
| Reviewed-by: Aaron Young <aaron.young@oracle.com> |
| Reviewed-by: Alexandre Chartre <alexandre.chartre@oracle.com> |
| Reviewed-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com> |
| Reviewed-by: Liam Merwick <liam.merwick@oracle.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| arch/sparc/kernel/ldc.c | 7 ++++++- |
| 1 file changed, 6 insertions(+), 1 deletion(-) |
| |
| --- a/arch/sparc/kernel/ldc.c |
| +++ b/arch/sparc/kernel/ldc.c |
| @@ -1733,9 +1733,14 @@ static int read_nonraw(struct ldc_channe |
| |
| lp->rcv_nxt = p->seqid; |
| |
| + /* |
| + * If this is a control-only packet, there is nothing |
| + * else to do but advance the rx queue since the packet |
| + * was already processed above. |
| + */ |
| if (!(p->type & LDC_DATA)) { |
| new = rx_advance(lp, new); |
| - goto no_data; |
| + break; |
| } |
| if (p->stype & (LDC_ACK | LDC_NACK)) { |
| err = data_ack_nack(lp, p); |
