Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
	include/net/inetpeer.h
	net/ipv6/output_core.c

Changes in net were fixing bugs in code removed in net-next.

Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 30 insertions, 15 deletions

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index d18441ebe944..23da47925fa3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -906,6 +906,18 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                 bd_prod = RX_BD(bd_prod);
                 bd_cons = RX_BD(bd_cons);
 
+                /* A rmb() is required to ensure that the CQE is not read
+                 * before it is written by the adapter DMA.  PCI ordering
+                 * rules will make sure the other fields are written before
+                 * the marker at the end of struct eth_fast_path_rx_cqe
+                 * but without rmb() a weakly ordered processor can process
+                 * stale data.  Without the barrier TPA state-machine might
+                 * enter inconsistent state and kernel stack might be
+                 * provided with incorrect packet description - these lead
+                 * to various kernel crashed.
+                 */
+                rmb();
+
                 cqe_fp_flags = cqe_fp->type_error_flags;
                 cqe_fp_type = cqe_fp_flags & ETH_FAST_PATH_RX_CQE_TYPE;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index ff2bdd80f0aa..cf14218697e4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13283,8 +13283,8 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
         netdev_reset_tc(bp->dev);
 
         del_timer_sync(&bp->timer);
-        cancel_delayed_work(&bp->sp_task);
-        cancel_delayed_work(&bp->period_task);
+        cancel_delayed_work_sync(&bp->sp_task);
+        cancel_delayed_work_sync(&bp->period_task);
 
         spin_lock_bh(&bp->stats_lock);
         bp->stats_state = STATS_STATE_DISABLED;
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 09f3fefcbf9c..a4b25bc7113a 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -608,6 +608,10 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
                 pr_err("%s: Bad type %d\n", __func__, ulp_type);
                 return -EINVAL;
         }
+
+        if (ulp_type == CNIC_ULP_ISCSI)
+                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+
         mutex_lock(&cnic_lock);
         if (rcu_dereference(cp->ulp_ops[ulp_type])) {
                 RCU_INIT_POINTER(cp->ulp_ops[ulp_type], NULL);
@@ -620,9 +624,7 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
         }
         mutex_unlock(&cnic_lock);
 
-        if (ulp_type == CNIC_ULP_ISCSI)
-                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
-        else if (ulp_type == CNIC_ULP_FCOE)
+        if (ulp_type == CNIC_ULP_FCOE)
                 dev->fcoe_cap = NULL;
 
         synchronize_rcu();
@@ -1039,21 +1041,17 @@ static int cnic_alloc_uio_rings(struct cnic_dev *dev, int pages)
         struct cnic_local *cp = dev->cnic_priv;
         struct cnic_uio_dev *udev;
 
-        read_lock(&cnic_dev_lock);
         list_for_each_entry(udev, &cnic_udev_list, list) {
                 if (udev->pdev == dev->pcidev) {
                         udev->dev = dev;
                         if (__cnic_alloc_uio_rings(udev, pages)) {
                                 udev->dev = NULL;
-                                read_unlock(&cnic_dev_lock);
                                 return -ENOMEM;
                         }
                         cp->udev = udev;
-                        read_unlock(&cnic_dev_lock);
                         return 0;
                 }
         }
-        read_unlock(&cnic_dev_lock);
 
         udev = kzalloc(sizeof(struct cnic_uio_dev), GFP_ATOMIC);
         if (!udev)
@@ -1067,9 +1065,7 @@ static int cnic_alloc_uio_rings(struct cnic_dev *dev, int pages)
         if (__cnic_alloc_uio_rings(udev, pages))
                 goto err_udev;
 
-        write_lock(&cnic_dev_lock);
         list_add(&udev->list, &cnic_udev_list);
-        write_unlock(&cnic_dev_lock);
 
         pci_dev_get(udev->pdev);
 
@@ -5624,20 +5620,27 @@ static void cnic_rcv_netevent(struct cnic_local *cp, unsigned long event,
 {
         int if_type;
 
-        rcu_read_lock();
         for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                 struct cnic_ulp_ops *ulp_ops;
                 void *ctx;
 
-                ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
-                if (!ulp_ops || !ulp_ops->indicate_netevent)
+                mutex_lock(&cnic_lock);
+                ulp_ops = rcu_dereference_protected(cp->ulp_ops[if_type],
+                                                lockdep_is_held(&cnic_lock));
+                if (!ulp_ops || !ulp_ops->indicate_netevent) {
+                        mutex_unlock(&cnic_lock);
                         continue;
+                }
 
                 ctx = cp->ulp_handle[if_type];
 
+                set_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
+                mutex_unlock(&cnic_lock);
+
                 ulp_ops->indicate_netevent(ctx, event, vlan_id);
+
+                clear_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
         }
-        rcu_read_unlock();
 }
 
 /* netdev event handler */