Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix stack allocation in s390 BPF JIT, from Michael Holzheu.

 2) Disable LRO on openvswitch paths, from Jiri Benc.

 3) UDP early demux doesn't handle multicast group membership properly,
    fix from Shawn Bohrer.

 4) Fix TX queue hang due to incorrect handling of mixed sized fragments
    and linearlization in i40e driver, from Anjali Singhai Jain.

 5) Cannot use disable_irq() in timer handler of AMD xgbe driver, from
    Thomas Lendacky.

 6) b2net driver improperly assumes pci_alloc_consistent() gives zero'd
    out memory, use dma_zalloc_coherent().  From Sriharsha Basavapatna.

 7) Fix use-after-free in MPLS and ipv6, from Robert Shearman.

 8) Missing neif_napi_del() calls in cleanup paths of b44 driver, from
    Hauke Mehrtens.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  net: replace last open coded skb_orphan_frags with function call
  net: bcmgenet: power on MII block for all MII modes
  ipv6: Fix protocol resubmission
  ipv6: fix possible use after free of dev stats
  b44: call netif_napi_del()
  bridge: disable softirqs around br_fdb_update to avoid lockup
  Revert "bridge: use _bh spinlock variant for br_fdb_update to avoid lockup"
  mpls: fix possible use after free of device
  be2net: Replace dma/pci_alloc_coherent() calls with dma_zalloc_coherent()
  bridge: use _bh spinlock variant for br_fdb_update to avoid lockup
  amd-xgbe: Use disable_irq_nosync from within timer function
  rhashtable: add missing import <linux/export.h>
  i40e: Make sure to be in VEB mode if SRIOV is enabled at probe
  i40e: start up in VEPA mode by default
  i40e/i40evf: Fix mixed size frags and linearization
  ipv4/udp: Verify multicast group is ours in upd_v4_early_demux()
  openvswitch: disable LRO
  s390/bpf: fix bpf frame pointer setup
  s390/bpf: fix stack allocation

2 files changed, 10 insertions, 5 deletions

diff --git a/arch/s390/net/bpf_jit.h b/arch/s390/net/bpf_jit.h
index ba8593a515ba..de156ba3bd71 100644
--- a/arch/s390/net/bpf_jit.h
+++ b/arch/s390/net/bpf_jit.h
@@ -48,7 +48,9 @@ extern u8 sk_load_word[], sk_load_half[], sk_load_byte[];
  * We get 160 bytes stack space from calling function, but only use
  * 11 * 8 byte (old backchain + r15 - r6) for storing registers.
  */
-#define STK_OFF (MAX_BPF_STACK + 8 + 4 + 4 + (160 - 11 * 8))
+#define STK_SPACE       (MAX_BPF_STACK + 8 + 4 + 4 + 160)
+#define STK_160_UNUSED  (160 - 11 * 8)
+#define STK_OFF         (STK_SPACE - STK_160_UNUSED)
 #define STK_OFF_TMP     160     /* Offset of tmp buffer on stack */
 #define STK_OFF_HLEN    168     /* Offset of SKB header length on stack */
 
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 20c146d1251a..55423d8be580 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -384,13 +384,16 @@ static void bpf_jit_prologue(struct bpf_jit *jit)
         }
         /* Setup stack and backchain */
         if (jit->seen & SEEN_STACK) {
-                /* lgr %bfp,%r15 (BPF frame pointer) */
-                EMIT4(0xb9040000, BPF_REG_FP, REG_15);
+                if (jit->seen & SEEN_FUNC)
+                        /* lgr %w1,%r15 (backchain) */
+                        EMIT4(0xb9040000, REG_W1, REG_15);
+                /* la %bfp,STK_160_UNUSED(%r15) (BPF frame pointer) */
+                EMIT4_DISP(0x41000000, BPF_REG_FP, REG_15, STK_160_UNUSED);
                 /* aghi %r15,-STK_OFF */
                 EMIT4_IMM(0xa70b0000, REG_15, -STK_OFF);
                 if (jit->seen & SEEN_FUNC)
-                        /* stg %bfp,152(%r15) (backchain) */
-                        EMIT6_DISP_LH(0xe3000000, 0x0024, BPF_REG_FP, REG_0,
+                        /* stg %w1,152(%r15) (backchain) */
+                        EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0,
                                       REG_15, 152);
         }
         /*