From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 20 Sep 2021 09:09:14 +0000 (+0200)
Subject: 4.9-stable patches
X-Git-Tag: v4.4.284~37
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=79ad353b7da83fa83ddab1498b4d5e324ae8ad93;p=thirdparty%2Fkernel%2Fstable-queue.git

4.9-stable patches

added patches:
	ibmvnic-check-failover_pending-in-login-response.patch
	tcp-fix-tp-undo_retrans-accounting-in-tcp_sacktag_one.patch
---

diff --git a/queue-4.9/ibmvnic-check-failover_pending-in-login-response.patch b/queue-4.9/ibmvnic-check-failover_pending-in-login-response.patch
new file mode 100644
index 00000000000..5aa07ab429e
--- /dev/null
+++ b/queue-4.9/ibmvnic-check-failover_pending-in-login-response.patch
@@ -0,0 +1,38 @@
+From 273c29e944bda9a20a30c26cfc34c9a3f363280b Mon Sep 17 00:00:00 2001
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Date: Wed, 8 Sep 2021 09:58:20 -0700
+Subject: ibmvnic: check failover_pending in login response
+
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+
+commit 273c29e944bda9a20a30c26cfc34c9a3f363280b upstream.
+
+If a failover occurs before a login response is received, the login
+response buffer maybe undefined. Check that there was no failover
+before accessing the login response buffer.
+
+Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2527,6 +2527,14 @@ static int handle_login_rsp(union ibmvni
+ 		return 0;
+ 	}
+ 
++	if (adapter->failover_pending) {
++		adapter->init_done_rc = -EAGAIN;
++		netdev_dbg(netdev, "Failover pending, ignoring login response\n");
++		complete(&adapter->init_done);
++		/* login response buffer will be released on reset */
++		return 0;
++	}
++
+ 	netdev_dbg(adapter->netdev, "Login Response Buffer:\n");
+ 	for (i = 0; i < (adapter->login_rsp_buf_sz - 1) / 8 + 1; i++) {
+ 		netdev_dbg(adapter->netdev, "%016lx\n",
diff --git a/queue-4.9/tcp-fix-tp-undo_retrans-accounting-in-tcp_sacktag_one.patch b/queue-4.9/tcp-fix-tp-undo_retrans-accounting-in-tcp_sacktag_one.patch
new file mode 100644
index 00000000000..4560695190f
--- /dev/null
+++ b/queue-4.9/tcp-fix-tp-undo_retrans-accounting-in-tcp_sacktag_one.patch
@@ -0,0 +1,42 @@
+From 4f884f3962767877d7aabbc1ec124d2c307a4257 Mon Sep 17 00:00:00 2001
+From: zhenggy <zhenggy@chinatelecom.cn>
+Date: Tue, 14 Sep 2021 09:51:15 +0800
+Subject: tcp: fix tp->undo_retrans accounting in tcp_sacktag_one()
+
+From: zhenggy <zhenggy@chinatelecom.cn>
+
+commit 4f884f3962767877d7aabbc1ec124d2c307a4257 upstream.
+
+Commit 10d3be569243 ("tcp-tso: do not split TSO packets at retransmit
+time") may directly retrans a multiple segments TSO/GSO packet without
+split, Since this commit, we can no longer assume that a retransmitted
+packet is a single segment.
+
+This patch fixes the tp->undo_retrans accounting in tcp_sacktag_one()
+that use the actual segments(pcount) of the retransmitted packet.
+
+Before that commit (10d3be569243), the assumption underlying the
+tp->undo_retrans-- seems correct.
+
+Fixes: 10d3be569243 ("tcp-tso: do not split TSO packets at retransmit time")
+Signed-off-by: zhenggy <zhenggy@chinatelecom.cn>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Yuchung Cheng <ycheng@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_input.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -1220,7 +1220,7 @@ static u8 tcp_sacktag_one(struct sock *s
+ 	if (dup_sack && (sacked & TCPCB_RETRANS)) {
+ 		if (tp->undo_marker && tp->undo_retrans > 0 &&
+ 		    after(end_seq, tp->undo_marker))
+-			tp->undo_retrans--;
++			tp->undo_retrans = max_t(int, 0, tp->undo_retrans - pcount);
+ 		if (sacked & TCPCB_SACKED_ACKED)
+ 			state->reord = min(fack_count, state->reord);
+ 	}