Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix ARM BPF JIT handling of negative 'k' values, from Chen Gang.

 2) Insufficient space reserved for bridge netlink values, fix from
    Stephen Hemminger.

 3) Some dst_neigh_lookup*() callers don't interpret error pointer
    correctly, fix from Zhouyi Zhou.

 4) Fix transport match in SCTP active_path loops, from Xugeng Zhang.

 5) Fix qeth driver handling of multi-order SKB frags, from Frank
    Blaschka.

 6) fec driver is missing napi_disable() call, resulting in crashes on
    unload, from Georg Hofmann.

 7) Don't try to handle PMTU events on a listening socket, fix from Eric
    Dumazet.

 8) Fix timestamp location calculations in IP option processing, from
    David Ward.

 9) FIB_TABLE_HASHSZ setting is not controlled by the correct kconfig
    tests, from Denis V Lunev.

10) Fix TX descriptor push handling in SFC driver, from Ben Hutchings.

11) Fix isdn/hisax and tulip/de4x5 kconfig dependencies, from Arnd
    Bergmann.

12) bnx2x statistics don't handle 4GB rollover correctly, fix from
    Maciej Żenczykowski.

13) Openvswitch bug fixes for vport del/new error reporting, missing
    genlmsg_end() call in netlink processing, and mis-parsing of
    LLC/SNAP ethernet types.  From Rich Lane.

14) SKB pfmemalloc state should only be propagated from the head page of
    a compound page, fix from Pavel Emelyanov.

15) Fix link handling in tg3 driver for 5715 chips when autonegotation
    is disabled.  From Nithin Sujir.

16) Fix inverted test of cpdma_check_free_tx_desc return value in
    davinci_emac driver, from Mugunthan V N.

17) vlan_depth is incorrectly calculated in skb_network_protocol(), from
    Li RongQing.

18) Fix probing of Gobi 1K devices in qmi_wwan driver, and fix NCM
    device mode backwards compat in cdc_ncm driver.  From Bjørn Mork.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits)
  inet: limit length of fragment queue hash table bucket lists
  qeth: Fix scatter-gather regression
  qeth: Fix invalid router settings handling
  qeth: delay feature trace
  tcp: dont handle MTU reduction on LISTEN socket
  bnx2x: fix occasional statistics off-by-4GB error
  vhost/net: fix heads usage of ubuf_info
  bridge: Add support for setting BR_ROOT_BLOCK flag.
  bnx2x: add missing napi deletion in error path
  drivers: net: ethernet: ti: davinci_emac: fix usage of cpdma_check_free_tx_desc()
  ethernet/tulip: DE4x5 needs VIRT_TO_BUS
  isdn: hisax: netjet requires VIRT_TO_BUS
  net: cdc_ncm, cdc_mbim: allow user to prefer NCM for backwards compatibility
  rtnetlink: Mask the rta_type when range checking
  Revert "ip_gre: make ipgre_tunnel_xmit() not parse network header as IP unconditionally"
  Fix dst_neigh_lookup/dst_neigh_lookup_skb return value handling bug
  smsc75xx: configuration help incorrectly mentions smsc95xx
  net: fec: fix missing napi_disable call
  net: fec: restart the FEC when PHY speed changes
  skb: Propagate pfmemalloc on skb from head page only
  ...

4 files changed, 56 insertions, 15 deletions

diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index d87961d4c0de..8c0622399fcd 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -916,6 +916,7 @@ int qeth_send_control_data(struct qeth_card *, int, struct qeth_cmd_buffer *,
         void *reply_param);
 int qeth_get_priority_queue(struct qeth_card *, struct sk_buff *, int, int);
 int qeth_get_elements_no(struct qeth_card *, void *, struct sk_buff *, int);
+int qeth_get_elements_for_frags(struct sk_buff *);
 int qeth_do_send_packet_fast(struct qeth_card *, struct qeth_qdio_out_q *,
                         struct sk_buff *, struct qeth_hdr *, int, int, int);
 int qeth_do_send_packet(struct qeth_card *, struct qeth_qdio_out_q *,
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 0d8cdff81813..0d73a999983d 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -3679,6 +3679,25 @@ int qeth_get_priority_queue(struct qeth_card *card, struct sk_buff *skb,
 }
 EXPORT_SYMBOL_GPL(qeth_get_priority_queue);
 
+int qeth_get_elements_for_frags(struct sk_buff *skb)
+{
+        int cnt, length, e, elements = 0;
+        struct skb_frag_struct *frag;
+        char *data;
+
+        for (cnt = 0; cnt < skb_shinfo(skb)->nr_frags; cnt++) {
+                frag = &skb_shinfo(skb)->frags[cnt];
+                data = (char *)page_to_phys(skb_frag_page(frag)) +
+                        frag->page_offset;
+                length = frag->size;
+                e = PFN_UP((unsigned long)data + length - 1) -
+                        PFN_DOWN((unsigned long)data);
+                elements += e;
+        }
+        return elements;
+}
+EXPORT_SYMBOL_GPL(qeth_get_elements_for_frags);
+
 int qeth_get_elements_no(struct qeth_card *card, void *hdr,
                      struct sk_buff *skb, int elems)
 {
@@ -3686,7 +3705,8 @@ int qeth_get_elements_no(struct qeth_card *card, void *hdr,
         int elements_needed = PFN_UP((unsigned long)skb->data + dlen - 1) -
                 PFN_DOWN((unsigned long)skb->data);
 
-        elements_needed += skb_shinfo(skb)->nr_frags;
+        elements_needed += qeth_get_elements_for_frags(skb);
+
         if ((elements_needed + elems) > QETH_MAX_BUFFER_ELEMENTS(card)) {
                 QETH_DBF_MESSAGE(2, "Invalid size of IP packet "
                         "(Number=%d / Length=%d). Discarded.\n",
@@ -3771,12 +3791,23 @@ static inline void __qeth_fill_buffer(struct sk_buff *skb,
 
         for (cnt = 0; cnt < skb_shinfo(skb)->nr_frags; cnt++) {
                 frag = &skb_shinfo(skb)->frags[cnt];
-                buffer->element[element].addr = (char *)
-                        page_to_phys(skb_frag_page(frag))
-                        + frag->page_offset;
-                buffer->element[element].length = frag->size;
-                buffer->element[element].eflags = SBAL_EFLAGS_MIDDLE_FRAG;
-                element++;
+                data = (char *)page_to_phys(skb_frag_page(frag)) +
+                        frag->page_offset;
+                length = frag->size;
+                while (length > 0) {
+                        length_here = PAGE_SIZE -
+                                ((unsigned long) data % PAGE_SIZE);
+                        if (length < length_here)
+                                length_here = length;
+
+                        buffer->element[element].addr = data;
+                        buffer->element[element].length = length_here;
+                        buffer->element[element].eflags =
+                                SBAL_EFLAGS_MIDDLE_FRAG;
+                        length -= length_here;
+                        data += length_here;
+                        element++;
+                }
         }
 
         if (buffer->element[element - 1].eflags)
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 091ca0efa1c5..8710337dab3e 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -623,7 +623,7 @@ static int qeth_l3_send_setrouting(struct qeth_card *card,
         return rc;
 }
 
-static void qeth_l3_correct_routing_type(struct qeth_card *card,
+static int qeth_l3_correct_routing_type(struct qeth_card *card,
                 enum qeth_routing_types *type, enum qeth_prot_versions prot)
 {
         if (card->info.type == QETH_CARD_TYPE_IQD) {
@@ -632,7 +632,7 @@ static void qeth_l3_correct_routing_type(struct qeth_card *card,
                 case PRIMARY_CONNECTOR:
                 case SECONDARY_CONNECTOR:
                 case MULTICAST_ROUTER:
-                        return;
+                        return 0;
                 default:
                         goto out_inval;
                 }
@@ -641,17 +641,18 @@ static void qeth_l3_correct_routing_type(struct qeth_card *card,
                 case NO_ROUTER:
                 case PRIMARY_ROUTER:
                 case SECONDARY_ROUTER:
-                        return;
+                        return 0;
                 case MULTICAST_ROUTER:
                         if (qeth_is_ipafunc_supported(card, prot,
                                                       IPA_OSA_MC_ROUTER))
-                                return;
+                                return 0;
                 default:
                         goto out_inval;
                 }
         }
 out_inval:
         *type = NO_ROUTER;
+        return -EINVAL;
 }
 
 int qeth_l3_setrouting_v4(struct qeth_card *card)
@@ -660,8 +661,10 @@ int qeth_l3_setrouting_v4(struct qeth_card *card)
 
         QETH_CARD_TEXT(card, 3, "setrtg4");
 
-        qeth_l3_correct_routing_type(card, &card->options.route4.type,
+        rc = qeth_l3_correct_routing_type(card, &card->options.route4.type,
                                   QETH_PROT_IPV4);
+        if (rc)
+                return rc;
 
         rc = qeth_l3_send_setrouting(card, card->options.route4.type,
                                   QETH_PROT_IPV4);
@@ -683,8 +686,10 @@ int qeth_l3_setrouting_v6(struct qeth_card *card)
 
         if (!qeth_is_supported(card, IPA_IPV6))
                 return 0;
-        qeth_l3_correct_routing_type(card, &card->options.route6.type,
+        rc = qeth_l3_correct_routing_type(card, &card->options.route6.type,
                                   QETH_PROT_IPV6);
+        if (rc)
+                return rc;
 
         rc = qeth_l3_send_setrouting(card, card->options.route6.type,
                                   QETH_PROT_IPV6);
@@ -2898,7 +2903,9 @@ static inline int qeth_l3_tso_elements(struct sk_buff *skb)
                 tcp_hdr(skb)->doff * 4;
         int tcpd_len = skb->len - (tcpd - (unsigned long)skb->data);
         int elements = PFN_UP(tcpd + tcpd_len - 1) - PFN_DOWN(tcpd);
-        elements += skb_shinfo(skb)->nr_frags;
+
+        elements += qeth_get_elements_for_frags(skb);
+
         return elements;
 }
 
@@ -3348,7 +3355,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode)
                 rc = -ENODEV;
                 goto out_remove;
         }
-        qeth_trace_features(card);
 
         if (!card->dev && qeth_l3_setup_netdev(card)) {
                 rc = -ENODEV;
@@ -3425,6 +3431,7 @@ contin:
                 qeth_l3_set_multicast_list(card->dev);
                 rtnl_unlock();
         }
+        qeth_trace_features(card);
         /* let user_space know that device is online */
         kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE);
         mutex_unlock(&card->conf_mutex);
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index ebc379486267..e70af2406ff9 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -87,6 +87,8 @@ static ssize_t qeth_l3_dev_route_store(struct qeth_card *card,
                         rc = qeth_l3_setrouting_v6(card);
         }
 out:
+        if (rc)
+                route->type = old_route_type;
         mutex_unlock(&card->conf_mutex);
         return rc ? rc : count;
 }