Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller: 1) Fix stack allocation in s390 BPF JIT, from Michael Holzheu. 2) Disable LRO on openvswitch paths, from Jiri Benc. 3) UDP early demux doesn't handle multicast group membership properly, fix from Shawn Bohrer. 4) Fix TX queue hang due to incorrect handling of mixed sized fragments and linearlization in i40e driver, from Anjali Singhai Jain. 5) Cannot use disable_irq() in timer handler of AMD xgbe driver, from Thomas Lendacky. 6) b2net driver improperly assumes pci_alloc_consistent() gives zero'd out memory, use dma_zalloc_coherent(). From Sriharsha Basavapatna. 7) Fix use-after-free in MPLS and ipv6, from Robert Shearman. 8) Missing neif_napi_del() calls in cleanup paths of b44 driver, from Hauke Mehrtens. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: net: replace last open coded skb_orphan_frags with function call net: bcmgenet: power on MII block for all MII modes ipv6: Fix protocol resubmission ipv6: fix possible use after free of dev stats b44: call netif_napi_del() bridge: disable softirqs around br_fdb_update to avoid lockup Revert "bridge: use _bh spinlock variant for br_fdb_update to avoid lockup" mpls: fix possible use after free of device be2net: Replace dma/pci_alloc_coherent() calls with dma_zalloc_coherent() bridge: use _bh spinlock variant for br_fdb_update to avoid lockup amd-xgbe: Use disable_irq_nosync from within timer function rhashtable: add missing import <linux/export.h> i40e: Make sure to be in VEB mode if SRIOV is enabled at probe i40e: start up in VEPA mode by default i40e/i40evf: Fix mixed size frags and linearization ipv4/udp: Verify multicast group is ours in upd_v4_early_demux() openvswitch: disable LRO s390/bpf: fix bpf frame pointer setup s390/bpf: fix stack allocation

Author: torvalds

arch/s390/net/bpf_jit.h

@@ -48,7 +48,9 @@ extern u8 sk_load_word[], sk_load_half[], sk_load_byte[];
  * We get 160 bytes stack space from calling function, but only use
  * 11 * 8 byte (old backchain + r15 - r6) for storing registers.
  */
-#define STK_OFF (MAX_BPF_STACK + 8 + 4 + 4 + (160 - 11 * 8))
+#define STK_SPACE(MAX_BPF_STACK + 8 + 4 + 4 + 160)
+#define STK_160_UNUSED(160 - 11 * 8)
+#define STK_OFF(STK_SPACE - STK_160_UNUSED)
 #define STK_OFF_TMP160/* Offset of tmp buffer on stack */
 #define STK_OFF_HLEN168/* Offset of SKB header length on stack */
 

arch/s390/net/bpf_jit_comp.c

@@ -384,13 +384,16 @@ static void bpf_jit_prologue(struct bpf_jit *jit)
 }
 /* Setup stack and backchain */
 if (jit->seen & SEEN_STACK) {
-/* lgr %bfp,%r15 (BPF frame pointer) */
-EMIT4(0xb9040000, BPF_REG_FP, REG_15);
+if (jit->seen & SEEN_FUNC)
+/* lgr %w1,%r15 (backchain) */
+EMIT4(0xb9040000, REG_W1, REG_15);
+/* la %bfp,STK_160_UNUSED(%r15) (BPF frame pointer) */
+EMIT4_DISP(0x41000000, BPF_REG_FP, REG_15, STK_160_UNUSED);
 /* aghi %r15,-STK_OFF */
 EMIT4_IMM(0xa70b0000, REG_15, -STK_OFF);
 if (jit->seen & SEEN_FUNC)
-/* stg %bfp,152(%r15) (backchain) */
-EMIT6_DISP_LH(0xe3000000, 0x0024, BPF_REG_FP, REG_0,
+/* stg %w1,152(%r15) (backchain) */
+EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0,
  REG_15, 152);
 }
 /*

drivers/net/ethernet/amd/xgbe/xgbe-drv.c

@@ -423,7 +423,7 @@ static void xgbe_tx_timer(unsigned long data)
 if (napi_schedule_prep(napi)) {
 /* Disable Tx and Rx interrupts */
 if (pdata->per_channel_irq)
-disable_irq(channel->dma_irq);
+disable_irq_nosync(channel->dma_irq);
 else
 xgbe_disable_rx_tx_ints(pdata);
 

drivers/net/ethernet/broadcom/b44.c

@@ -2464,6 +2464,7 @@ static int b44_init_one(struct ssb_device *sdev,
 ssb_bus_may_powerdown(sdev->bus);
 
 err_out_free_dev:
+netif_napi_del(&bp->napi);
 free_netdev(dev);
 
 out:
@@ -2480,6 +2481,7 @@ static void b44_remove_one(struct ssb_device *sdev)
 b44_unregister_phy_one(bp);
 ssb_device_disable(sdev, 0);
 ssb_bus_may_powerdown(sdev->bus);
+netif_napi_del(&bp->napi);
 free_netdev(dev);
 ssb_pcihost_set_power_state(sdev, PCI_D3hot);
 ssb_set_drvdata(sdev, NULL);

drivers/net/ethernet/broadcom/genet/bcmmii.c

@@ -299,9 +299,6 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
 phy_name = "external RGMII (no delay)";
 else
 phy_name = "external RGMII (TX delay)";
-reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL);
-reg |= RGMII_MODE_EN | id_mode_dis;
-bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
 bcmgenet_sys_writel(priv,
  PORT_MODE_EXT_GPHY, SYS_PORT_CTRL);
 break;
@@ -310,6 +307,15 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
 return -EINVAL;
 }
 
+/* This is an external PHY (xMII), so we need to enable the RGMII
+ * block for the interface to work
+ */
+if (priv->ext_phy) {
+reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL);
+reg |= RGMII_MODE_EN | id_mode_dis;
+bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
+}
+
 if (init)
 dev_info(kdev, "configuring instance for %s\n", phy_name);
 

drivers/net/ethernet/emulex/benet/be_cmds.c

@@ -1720,9 +1720,9 @@ int be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf)
 total_size = buf_len;
 
 get_fat_cmd.size = sizeof(struct be_cmd_req_get_fat) + 60*1024;
-get_fat_cmd.va = pci_alloc_consistent(adapter->pdev,
-  get_fat_cmd.size,
-  &get_fat_cmd.dma);
+get_fat_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
+ get_fat_cmd.size,
+ &get_fat_cmd.dma, GFP_ATOMIC);
 if (!get_fat_cmd.va) {
 dev_err(&adapter->pdev->dev,
 "Memory allocation failure while reading FAT data\n");
@@ -1767,8 +1767,8 @@ int be_cmd_get_regs(struct be_adapter *adapter, u32 buf_len, void *buf)
 log_offset += buf_size;
 }
 err:
-pci_free_consistent(adapter->pdev, get_fat_cmd.size,
-  get_fat_cmd.va, get_fat_cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, get_fat_cmd.size,
+ get_fat_cmd.va, get_fat_cmd.dma);
 spin_unlock_bh(&adapter->mcc_lock);
 return status;
 }
@@ -2215,12 +2215,12 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter,
 return -EINVAL;
 
 cmd.size = sizeof(struct be_cmd_resp_port_type);
-cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
+cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
+ GFP_ATOMIC);
 if (!cmd.va) {
 dev_err(&adapter->pdev->dev, "Memory allocation failed\n");
 return -ENOMEM;
 }
-memset(cmd.va, 0, cmd.size);
 
 spin_lock_bh(&adapter->mcc_lock);
 
@@ -2245,7 +2245,7 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter,
 }
 err:
 spin_unlock_bh(&adapter->mcc_lock);
-pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va, cmd.dma);
 return status;
 }
 
@@ -2720,7 +2720,8 @@ int be_cmd_get_phy_info(struct be_adapter *adapter)
 goto err;
 }
 cmd.size = sizeof(struct be_cmd_req_get_phy_info);
-cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
+cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
+ GFP_ATOMIC);
 if (!cmd.va) {
 dev_err(&adapter->pdev->dev, "Memory alloc failure\n");
 status = -ENOMEM;
@@ -2754,7 +2755,7 @@ int be_cmd_get_phy_info(struct be_adapter *adapter)
 BE_SUPPORTED_SPEED_1GBPS;
 }
 }
-pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va, cmd.dma);
 err:
 spin_unlock_bh(&adapter->mcc_lock);
 return status;
@@ -2805,8 +2806,9 @@ int be_cmd_get_cntl_attributes(struct be_adapter *adapter)
 
 memset(&attribs_cmd, 0, sizeof(struct be_dma_mem));
 attribs_cmd.size = sizeof(struct be_cmd_resp_cntl_attribs);
-attribs_cmd.va = pci_alloc_consistent(adapter->pdev, attribs_cmd.size,
- &attribs_cmd.dma);
+attribs_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
+ attribs_cmd.size,
+ &attribs_cmd.dma, GFP_ATOMIC);
 if (!attribs_cmd.va) {
 dev_err(&adapter->pdev->dev, "Memory allocation failure\n");
 status = -ENOMEM;
@@ -2833,8 +2835,8 @@ int be_cmd_get_cntl_attributes(struct be_adapter *adapter)
 err:
 mutex_unlock(&adapter->mbox_lock);
 if (attribs_cmd.va)
-pci_free_consistent(adapter->pdev, attribs_cmd.size,
-  attribs_cmd.va, attribs_cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, attribs_cmd.size,
+ attribs_cmd.va, attribs_cmd.dma);
 return status;
 }
 
@@ -2972,9 +2974,10 @@ int be_cmd_get_mac_from_list(struct be_adapter *adapter, u8 *mac,
 
 memset(&get_mac_list_cmd, 0, sizeof(struct be_dma_mem));
 get_mac_list_cmd.size = sizeof(struct be_cmd_resp_get_mac_list);
-get_mac_list_cmd.va = pci_alloc_consistent(adapter->pdev,
- get_mac_list_cmd.size,
- &get_mac_list_cmd.dma);
+get_mac_list_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
+ get_mac_list_cmd.size,
+ &get_mac_list_cmd.dma,
+ GFP_ATOMIC);
 
 if (!get_mac_list_cmd.va) {
 dev_err(&adapter->pdev->dev,
@@ -3047,8 +3050,8 @@ int be_cmd_get_mac_from_list(struct be_adapter *adapter, u8 *mac,
 
 out:
 spin_unlock_bh(&adapter->mcc_lock);
-pci_free_consistent(adapter->pdev, get_mac_list_cmd.size,
-  get_mac_list_cmd.va, get_mac_list_cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, get_mac_list_cmd.size,
+ get_mac_list_cmd.va, get_mac_list_cmd.dma);
 return status;
 }
 
@@ -3101,8 +3104,8 @@ int be_cmd_set_mac_list(struct be_adapter *adapter, u8 *mac_array,
 
 memset(&cmd, 0, sizeof(struct be_dma_mem));
 cmd.size = sizeof(struct be_cmd_req_set_mac_list);
-cmd.va = dma_alloc_coherent(&adapter->pdev->dev, cmd.size,
- &cmd.dma, GFP_KERNEL);
+cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
+ GFP_KERNEL);
 if (!cmd.va)
 return -ENOMEM;
 
@@ -3291,7 +3294,8 @@ int be_cmd_get_acpi_wol_cap(struct be_adapter *adapter)
 
 memset(&cmd, 0, sizeof(struct be_dma_mem));
 cmd.size = sizeof(struct be_cmd_resp_acpi_wol_magic_config_v1);
-cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
+cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
+ GFP_ATOMIC);
 if (!cmd.va) {
 dev_err(&adapter->pdev->dev, "Memory allocation failure\n");
 status = -ENOMEM;
@@ -3326,7 +3330,8 @@ int be_cmd_get_acpi_wol_cap(struct be_adapter *adapter)
 err:
 mutex_unlock(&adapter->mbox_lock);
 if (cmd.va)
-pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va,
+ cmd.dma);
 return status;
 
 }
@@ -3340,8 +3345,9 @@ int be_cmd_set_fw_log_level(struct be_adapter *adapter, u32 level)
 
 memset(&extfat_cmd, 0, sizeof(struct be_dma_mem));
 extfat_cmd.size = sizeof(struct be_cmd_resp_get_ext_fat_caps);
-extfat_cmd.va = pci_alloc_consistent(adapter->pdev, extfat_cmd.size,
- &extfat_cmd.dma);
+extfat_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
+ extfat_cmd.size, &extfat_cmd.dma,
+ GFP_ATOMIC);
 if (!extfat_cmd.va)
 return -ENOMEM;
 
@@ -3363,8 +3369,8 @@ int be_cmd_set_fw_log_level(struct be_adapter *adapter, u32 level)
 
 status = be_cmd_set_ext_fat_capabilites(adapter, &extfat_cmd, cfgs);
 err:
-pci_free_consistent(adapter->pdev, extfat_cmd.size, extfat_cmd.va,
-  extfat_cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, extfat_cmd.size, extfat_cmd.va,
+ extfat_cmd.dma);
 return status;
 }
 
@@ -3377,8 +3383,9 @@ int be_cmd_get_fw_log_level(struct be_adapter *adapter)
 
 memset(&extfat_cmd, 0, sizeof(struct be_dma_mem));
 extfat_cmd.size = sizeof(struct be_cmd_resp_get_ext_fat_caps);
-extfat_cmd.va = pci_alloc_consistent(adapter->pdev, extfat_cmd.size,
- &extfat_cmd.dma);
+extfat_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
+ extfat_cmd.size, &extfat_cmd.dma,
+ GFP_ATOMIC);
 
 if (!extfat_cmd.va) {
 dev_err(&adapter->pdev->dev, "%s: Memory allocation failure\n",
@@ -3396,8 +3403,8 @@ int be_cmd_get_fw_log_level(struct be_adapter *adapter)
 level = cfgs->module[0].trace_lvl[j].dbg_lvl;
 }
 }
-pci_free_consistent(adapter->pdev, extfat_cmd.size, extfat_cmd.va,
-  extfat_cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, extfat_cmd.size, extfat_cmd.va,
+ extfat_cmd.dma);
 err:
 return level;
 }
@@ -3595,7 +3602,8 @@ int be_cmd_get_func_config(struct be_adapter *adapter, struct be_resources *res)
 
 memset(&cmd, 0, sizeof(struct be_dma_mem));
 cmd.size = sizeof(struct be_cmd_resp_get_func_config);
-cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
+cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
+ GFP_ATOMIC);
 if (!cmd.va) {
 dev_err(&adapter->pdev->dev, "Memory alloc failure\n");
 status = -ENOMEM;
@@ -3635,7 +3643,8 @@ int be_cmd_get_func_config(struct be_adapter *adapter, struct be_resources *res)
 err:
 mutex_unlock(&adapter->mbox_lock);
 if (cmd.va)
-pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va,
+ cmd.dma);
 return status;
 }
 
@@ -3656,7 +3665,8 @@ int be_cmd_get_profile_config(struct be_adapter *adapter,
 
 memset(&cmd, 0, sizeof(struct be_dma_mem));
 cmd.size = sizeof(struct be_cmd_resp_get_profile_config);
-cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
+cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
+ GFP_ATOMIC);
 if (!cmd.va)
 return -ENOMEM;
 
@@ -3702,7 +3712,8 @@ int be_cmd_get_profile_config(struct be_adapter *adapter,
 res->vf_if_cap_flags = vf_res->cap_flags;
 err:
 if (cmd.va)
-pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va,
+ cmd.dma);
 return status;
 }
 
@@ -3717,7 +3728,8 @@ static int be_cmd_set_profile_config(struct be_adapter *adapter, void *desc,
 
 memset(&cmd, 0, sizeof(struct be_dma_mem));
 cmd.size = sizeof(struct be_cmd_req_set_profile_config);
-cmd.va = pci_alloc_consistent(adapter->pdev, cmd.size, &cmd.dma);
+cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, cmd.size, &cmd.dma,
+ GFP_ATOMIC);
 if (!cmd.va)
 return -ENOMEM;
 
@@ -3733,7 +3745,8 @@ static int be_cmd_set_profile_config(struct be_adapter *adapter, void *desc,
 status = be_cmd_notify_wait(adapter, &wrb);
 
 if (cmd.va)
-pci_free_consistent(adapter->pdev, cmd.size, cmd.va, cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va,
+ cmd.dma);
 return status;
 }
 

drivers/net/ethernet/emulex/benet/be_ethtool.c

@@ -264,8 +264,8 @@ static int lancer_cmd_read_file(struct be_adapter *adapter, u8 *file_name,
 int status = 0;
 
 read_cmd.size = LANCER_READ_FILE_CHUNK;
-read_cmd.va = pci_alloc_consistent(adapter->pdev, read_cmd.size,
-  &read_cmd.dma);
+read_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev, read_cmd.size,
+ &read_cmd.dma, GFP_ATOMIC);
 
 if (!read_cmd.va) {
 dev_err(&adapter->pdev->dev,
@@ -289,8 +289,8 @@ static int lancer_cmd_read_file(struct be_adapter *adapter, u8 *file_name,
 break;
 }
 }
-pci_free_consistent(adapter->pdev, read_cmd.size, read_cmd.va,
-  read_cmd.dma);
+dma_free_coherent(&adapter->pdev->dev, read_cmd.size, read_cmd.va,
+ read_cmd.dma);
 
 return status;
 }
@@ -818,8 +818,9 @@ static int be_test_ddr_dma(struct be_adapter *adapter)
 };
 
 ddrdma_cmd.size = sizeof(struct be_cmd_req_ddrdma_test);
-ddrdma_cmd.va = dma_alloc_coherent(&adapter->pdev->dev, ddrdma_cmd.size,
- &ddrdma_cmd.dma, GFP_KERNEL);
+ddrdma_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
+ ddrdma_cmd.size, &ddrdma_cmd.dma,
+ GFP_KERNEL);
 if (!ddrdma_cmd.va)
 return -ENOMEM;
 
@@ -941,8 +942,9 @@ static int be_read_eeprom(struct net_device *netdev,
 
 memset(&eeprom_cmd, 0, sizeof(struct be_dma_mem));
 eeprom_cmd.size = sizeof(struct be_cmd_req_seeprom_read);
-eeprom_cmd.va = dma_alloc_coherent(&adapter->pdev->dev, eeprom_cmd.size,
- &eeprom_cmd.dma, GFP_KERNEL);
+eeprom_cmd.va = dma_zalloc_coherent(&adapter->pdev->dev,
+ eeprom_cmd.size, &eeprom_cmd.dma,
+ GFP_KERNEL);
 
 if (!eeprom_cmd.va)
 return -ENOMEM;