[PATCH 4.9 239/310] sparc64: ldc abort during vds iso boot

[Greg Kroah-Hartman]

4.9-stable review patch.  If anyone has any objections, please let me know.

--

From: Jag Raman 


[ Upstream commit 6c95483b768c62f8ee933ae08a1bdbcb78b5410f ]

Orabug: 20902628

When an ldc control-only packet is received during data exchange in
read_nonraw(), a new rx head is calculated but the rx queue head is not
actually advanced (rx_set_head() is not called) and a branch is taken to
'no_data' at which point two things can happen depending on the value
of the newly calculated rx head and the current rx tail:

- If the rx queue is determined to be not empty, then the wrong packet
  is picked up.

- If the rx queue is determined to be empty, then a read error (EAGAIN)
  is eventually returned since it is falsely assumed that more data was
  expected.

The fix is to update the rx head and return in case of a control only
packet during data exchange.

Signed-off-by: Jagannathan Raman 
Reviewed-by: Aaron Young 
Reviewed-by: Alexandre Chartre 
Reviewed-by: Bijan Mottahedeh 
Reviewed-by: Liam Merwick 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/sparc/kernel/ldc.c |7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/arch/sparc/kernel/ldc.c
+++ b/arch/sparc/kernel/ldc.c
@@ -1733,9 +1733,14 @@ static int read_nonraw(struct ldc_channe
 
lp->rcv_nxt = p->seqid;
 
+   /*
+* If this is a control-only packet, there is nothing
+* else to do but advance the rx queue since the packet
+* was already processed above.
+*/
if (!(p->type & LDC_DATA)) {
new = rx_advance(lp, new);
-   goto no_data;
+   break;
}
if (p->stype & (LDC_ACK | LDC_NACK)) {
err = data_ack_nack(lp, p);

[PATCH 4.9 239/310] sparc64: ldc abort during vds iso boot

[Greg Kroah-Hartman]

4.9-stable review patch.  If anyone has any objections, please let me know.

--

From: Jag Raman 


[ Upstream commit 6c95483b768c62f8ee933ae08a1bdbcb78b5410f ]

Orabug: 20902628

When an ldc control-only packet is received during data exchange in
read_nonraw(), a new rx head is calculated but the rx queue head is not
actually advanced (rx_set_head() is not called) and a branch is taken to
'no_data' at which point two things can happen depending on the value
of the newly calculated rx head and the current rx tail:

- If the rx queue is determined to be not empty, then the wrong packet
  is picked up.

- If the rx queue is determined to be empty, then a read error (EAGAIN)
  is eventually returned since it is falsely assumed that more data was
  expected.

The fix is to update the rx head and return in case of a control only
packet during data exchange.

Signed-off-by: Jagannathan Raman 
Reviewed-by: Aaron Young 
Reviewed-by: Alexandre Chartre 
Reviewed-by: Bijan Mottahedeh 
Reviewed-by: Liam Merwick 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/sparc/kernel/ldc.c |7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/arch/sparc/kernel/ldc.c
+++ b/arch/sparc/kernel/ldc.c
@@ -1733,9 +1733,14 @@ static int read_nonraw(struct ldc_channe
 
lp->rcv_nxt = p->seqid;
 
+   /*
+* If this is a control-only packet, there is nothing
+* else to do but advance the rx queue since the packet
+* was already processed above.
+*/
if (!(p->type & LDC_DATA)) {
new = rx_advance(lp, new);
-   goto no_data;
+   break;
}
if (p->stype & (LDC_ACK | LDC_NACK)) {
err = data_ack_nack(lp, p);