1 files changed, 17 insertions, 15 deletions

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 73f596a90c69..f17f602e6171 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -87,8 +87,7 @@ struct netfront_cb {
 /* IRQ name is queue name with "-tx" or "-rx" appended */
 #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
 
-static DECLARE_WAIT_QUEUE_HEAD(module_load_q);
-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q);
+static DECLARE_WAIT_QUEUE_HEAD(module_wq);
 
 struct netfront_stats {
         u64                     packets;
@@ -909,7 +908,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
                         BUG_ON(pull_to <= skb_headlen(skb));
                         __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
                 }
-                BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
+                if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+                        queue->rx.rsp_cons = ++cons;
+                        kfree_skb(nskb);
+                        return ~0U;
+                }
 
                 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
                                 skb_frag_page(nfrag),
@@ -1046,6 +1049,8 @@ err:
                 skb->len += rx->status;
 
                 i = xennet_fill_frags(queue, skb, &tmpq);
+                if (unlikely(i == ~0U))
+                        goto err;
 
                 if (rx->flags & XEN_NETRXF_csum_blank)
                         skb->ip_summed = CHECKSUM_PARTIAL;
@@ -1332,11 +1337,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
         netif_carrier_off(netdev);
 
         xenbus_switch_state(dev, XenbusStateInitialising);
-        wait_event(module_load_q,
-                           xenbus_read_driver_state(dev->otherend) !=
-                           XenbusStateClosed &&
-                           xenbus_read_driver_state(dev->otherend) !=
-                           XenbusStateUnknown);
+        wait_event(module_wq,
+                   xenbus_read_driver_state(dev->otherend) !=
+                   XenbusStateClosed &&
+                   xenbus_read_driver_state(dev->otherend) !=
+                   XenbusStateUnknown);
         return netdev;
 
  exit:
@@ -2010,15 +2015,14 @@ static void netback_changed(struct xenbus_device *dev,
 
         dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state));
 
+        wake_up_all(&module_wq);
+
         switch (backend_state) {
         case XenbusStateInitialising:
         case XenbusStateInitialised:
         case XenbusStateReconfiguring:
         case XenbusStateReconfigured:
-                break;
-
         case XenbusStateUnknown:
-                wake_up_all(&module_unload_q);
                 break;
 
         case XenbusStateInitWait:
@@ -2034,12 +2038,10 @@ static void netback_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateClosed:
-                wake_up_all(&module_unload_q);
                 if (dev->state == XenbusStateClosed)
                         break;
                 /* Missed the backend's CLOSING state -- fallthrough */
         case XenbusStateClosing:
-                wake_up_all(&module_unload_q);
                 xenbus_frontend_closed(dev);
                 break;
         }
@@ -2147,14 +2149,14 @@ static int xennet_remove(struct xenbus_device *dev)
 
         if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
                 xenbus_switch_state(dev, XenbusStateClosing);
-                wait_event(module_unload_q,
+                wait_event(module_wq,
                            xenbus_read_driver_state(dev->otherend) ==
                            XenbusStateClosing ||
                            xenbus_read_driver_state(dev->otherend) ==
                            XenbusStateUnknown);
 
                 xenbus_switch_state(dev, XenbusStateClosed);
-                wait_event(module_unload_q,
+                wait_event(module_wq,
                            xenbus_read_driver_state(dev->otherend) ==
                            XenbusStateClosed ||
                            xenbus_read_driver_state(dev->otherend) ==