4.9-stable patches

added patches:
	ibmvnic-check-failover_pending-in-login-response.patch
	tcp-fix-tp-undo_retrans-accounting-in-tcp_sacktag_one.patch

diff --git a/queue-4.9/ibmvnic-check-failover_pending-in-login-response.patch b/queue-4.9/ibmvnic-check-failover_pending-in-login-response.patch
new file mode 100644 (file)
index 0000000..5aa07ab
--- /dev/null
+++ b/queue-4.9/ibmvnic-check-failover_pending-in-login-response.patch
@@ -0,0 +1,38 @@
+From 273c29e944bda9a20a30c26cfc34c9a3f363280b Mon Sep 17 00:00:00 2001
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Date: Wed, 8 Sep 2021 09:58:20 -0700
+Subject: ibmvnic: check failover_pending in login response
+
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+
+commit 273c29e944bda9a20a30c26cfc34c9a3f363280b upstream.
+
+If a failover occurs before a login response is received, the login
+response buffer maybe undefined. Check that there was no failover
+before accessing the login response buffer.
+
+Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2527,6 +2527,14 @@ static int handle_login_rsp(union ibmvni
+               return 0;
+       }
+ 
++      if (adapter->failover_pending) {
++              adapter->init_done_rc = -EAGAIN;
++              netdev_dbg(netdev, "Failover pending, ignoring login response\n");
++              complete(&adapter->init_done);
++              /* login response buffer will be released on reset */
++              return 0;
++      }
++
+       netdev_dbg(adapter->netdev, "Login Response Buffer:\n");
+       for (i = 0; i < (adapter->login_rsp_buf_sz - 1) / 8 + 1; i++) {
+               netdev_dbg(adapter->netdev, "%016lx\n",

diff --git a/queue-4.9/tcp-fix-tp-undo_retrans-accounting-in-tcp_sacktag_one.patch b/queue-4.9/tcp-fix-tp-undo_retrans-accounting-in-tcp_sacktag_one.patch
new file mode 100644 (file)
index 0000000..4560695
--- /dev/null
+++ b/queue-4.9/tcp-fix-tp-undo_retrans-accounting-in-tcp_sacktag_one.patch
@@ -0,0 +1,42 @@
+From 4f884f3962767877d7aabbc1ec124d2c307a4257 Mon Sep 17 00:00:00 2001
+From: zhenggy <zhenggy@chinatelecom.cn>
+Date: Tue, 14 Sep 2021 09:51:15 +0800
+Subject: tcp: fix tp->undo_retrans accounting in tcp_sacktag_one()
+
+From: zhenggy <zhenggy@chinatelecom.cn>
+
+commit 4f884f3962767877d7aabbc1ec124d2c307a4257 upstream.
+
+Commit 10d3be569243 ("tcp-tso: do not split TSO packets at retransmit
+time") may directly retrans a multiple segments TSO/GSO packet without
+split, Since this commit, we can no longer assume that a retransmitted
+packet is a single segment.
+
+This patch fixes the tp->undo_retrans accounting in tcp_sacktag_one()
+that use the actual segments(pcount) of the retransmitted packet.
+
+Before that commit (10d3be569243), the assumption underlying the
+tp->undo_retrans-- seems correct.
+
+Fixes: 10d3be569243 ("tcp-tso: do not split TSO packets at retransmit time")
+Signed-off-by: zhenggy <zhenggy@chinatelecom.cn>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Yuchung Cheng <ycheng@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_input.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -1220,7 +1220,7 @@ static u8 tcp_sacktag_one(struct sock *s
+       if (dup_sack && (sacked & TCPCB_RETRANS)) {
+               if (tp->undo_marker && tp->undo_retrans > 0 &&
+                   after(end_seq, tp->undo_marker))
+-                      tp->undo_retrans--;
++                      tp->undo_retrans = max_t(int, 0, tp->undo_retrans - pcount);
+               if (sacked & TCPCB_SACKED_ACKED)
+                       state->reord = min(fack_count, state->reord);
+       }