Commit 6c95483b authored by Jag Raman's avatar Jag Raman Committed by David S. Miller

sparc64: ldc abort during vds iso boot

Orabug: 20902628

When an ldc control-only packet is received during data exchange in
read_nonraw(), a new rx head is calculated but the rx queue head is not
actually advanced (rx_set_head() is not called) and a branch is taken to
'no_data' at which point two things can happen depending on the value
of the newly calculated rx head and the current rx tail:

- If the rx queue is determined to be not empty, then the wrong packet
  is picked up.

- If the rx queue is determined to be empty, then a read error (EAGAIN)
  is eventually returned since it is falsely assumed that more data was
  expected.

The fix is to update the rx head and return in case of a control only
packet during data exchange.
Signed-off-by: default avatarJagannathan Raman <jag.raman@oracle.com>
Reviewed-by: default avatarAaron Young <aaron.young@oracle.com>
Reviewed-by: default avatarAlexandre Chartre <alexandre.chartre@oracle.com>
Reviewed-by: default avatarBijan Mottahedeh <bijan.mottahedeh@oracle.com>
Reviewed-by: default avatarLiam Merwick <liam.merwick@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fc43b978
......@@ -1778,9 +1778,14 @@ static int read_nonraw(struct ldc_channel *lp, void *buf, unsigned int size)
lp->rcv_nxt = p->seqid;
/*
* If this is a control-only packet, there is nothing
* else to do but advance the rx queue since the packet
* was already processed above.
*/
if (!(p->type & LDC_DATA)) {
new = rx_advance(lp, new);
goto no_data;
break;
}
if (p->stype & (LDC_ACK | LDC_NACK)) {
err = data_ack_nack(lp, p);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment