lkml.org 
[lkml]   [2018]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 084/121] sparc64: ldc abort during vds iso boot
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jag Raman <jag.raman@oracle.com>


    [ Upstream commit 6c95483b768c62f8ee933ae08a1bdbcb78b5410f ]

    Orabug: 20902628

    When an ldc control-only packet is received during data exchange in
    read_nonraw(), a new rx head is calculated but the rx queue head is not
    actually advanced (rx_set_head() is not called) and a branch is taken to
    'no_data' at which point two things can happen depending on the value
    of the newly calculated rx head and the current rx tail:

    - If the rx queue is determined to be not empty, then the wrong packet
    is picked up.

    - If the rx queue is determined to be empty, then a read error (EAGAIN)
    is eventually returned since it is falsely assumed that more data was
    expected.

    The fix is to update the rx head and return in case of a control only
    packet during data exchange.

    Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
    Reviewed-by: Aaron Young <aaron.young@oracle.com>
    Reviewed-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Reviewed-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
    Reviewed-by: Liam Merwick <liam.merwick@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/sparc/kernel/ldc.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    --- a/arch/sparc/kernel/ldc.c
    +++ b/arch/sparc/kernel/ldc.c
    @@ -1693,9 +1693,14 @@ static int read_nonraw(struct ldc_channe

    lp->rcv_nxt = p->seqid;

    + /*
    + * If this is a control-only packet, there is nothing
    + * else to do but advance the rx queue since the packet
    + * was already processed above.
    + */
    if (!(p->type & LDC_DATA)) {
    new = rx_advance(lp, new);
    - goto no_data;
    + break;
    }
    if (p->stype & (LDC_ACK | LDC_NACK)) {
    err = data_ack_nack(lp, p);

    \
     
     \ /
      Last update: 2018-04-11 23:02    [W:2.023 / U:0.612 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site