2 files changed, 25 insertions, 23 deletions

diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index f38227afe099..3aa8648080c8 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -340,12 +340,11 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
         unsigned int num_queues = vif->num_queues;
         int i;
         unsigned int queue_index;
-        struct xenvif_stats *vif_stats;
 
         for (i = 0; i < ARRAY_SIZE(xenvif_stats); i++) {
                 unsigned long accum = 0;
                 for (queue_index = 0; queue_index < num_queues; ++queue_index) {
-                        vif_stats = &vif->queues[queue_index].stats;
+                        void *vif_stats = &vif->queues[queue_index].stats;
                         accum += *(unsigned long *)(vif_stats + xenvif_stats[i].offset);
                 }
                 data[i] = accum;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index c4d68d768408..997cf0901ac2 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -96,6 +96,7 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 static void make_tx_response(struct xenvif_queue *queue,
                              struct xen_netif_tx_request *txp,
                              s8       st);
+static void push_tx_responses(struct xenvif_queue *queue);
 
 static inline int tx_work_todo(struct xenvif_queue *queue);
 
@@ -655,15 +656,10 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
         unsigned long flags;
 
         do {
-                int notify;
-
                 spin_lock_irqsave(&queue->response_lock, flags);
                 make_tx_response(queue, txp, XEN_NETIF_RSP_ERROR);
-                RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+                push_tx_responses(queue);
                 spin_unlock_irqrestore(&queue->response_lock, flags);
-                if (notify)
-                        notify_remote_via_irq(queue->tx_irq);
-
                 if (cons == end)
                         break;
                 txp = RING_GET_REQUEST(&queue->tx, cons++);
@@ -1349,7 +1345,7 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s
 {
         unsigned int offset = skb_headlen(skb);
         skb_frag_t frags[MAX_SKB_FRAGS];
-        int i;
+        int i, f;
         struct ubuf_info *uarg;
         struct sk_buff *nskb = skb_shinfo(skb)->frag_list;
 
@@ -1389,23 +1385,25 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s
                 frags[i].page_offset = 0;
                 skb_frag_size_set(&frags[i], len);
         }
-        /* swap out with old one */
-        memcpy(skb_shinfo(skb)->frags,
-               frags,
-               i * sizeof(skb_frag_t));
-        skb_shinfo(skb)->nr_frags = i;
-        skb->truesize += i * PAGE_SIZE;
 
-        /* remove traces of mapped pages and frag_list */
+        /* Copied all the bits from the frag list -- free it. */
         skb_frag_list_init(skb);
+        xenvif_skb_zerocopy_prepare(queue, nskb);
+        kfree_skb(nskb);
+
+        /* Release all the original (foreign) frags. */
+        for (f = 0; f < skb_shinfo(skb)->nr_frags; f++)
+                skb_frag_unref(skb, f);
         uarg = skb_shinfo(skb)->destructor_arg;
         /* increase inflight counter to offset decrement in callback */
         atomic_inc(&queue->inflight_packets);
         uarg->callback(uarg, true);
         skb_shinfo(skb)->destructor_arg = NULL;
 
-        xenvif_skb_zerocopy_prepare(queue, nskb);
-        kfree_skb(nskb);
+        /* Fill the skb with the new (local) frags. */
+        memcpy(skb_shinfo(skb)->frags, frags, i * sizeof(skb_frag_t));
+        skb_shinfo(skb)->nr_frags = i;
+        skb->truesize += i * PAGE_SIZE;
 
         return 0;
 }
@@ -1655,7 +1653,6 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 {
         struct pending_tx_info *pending_tx_info;
         pending_ring_idx_t index;
-        int notify;
         unsigned long flags;
 
         pending_tx_info = &queue->pending_tx_info[pending_idx];
@@ -1671,12 +1668,9 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
         index = pending_index(queue->pending_prod++);
         queue->pending_ring[index] = pending_idx;
 
-        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        push_tx_responses(queue);
 
         spin_unlock_irqrestore(&queue->response_lock, flags);
-
-        if (notify)
-                notify_remote_via_irq(queue->tx_irq);
 }
 
 
@@ -1697,6 +1691,15 @@ static void make_tx_response(struct xenvif_queue *queue,
         queue->tx.rsp_prod_pvt = ++i;
 }
 
+static void push_tx_responses(struct xenvif_queue *queue)
+{
+        int notify;
+
+        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        if (notify)
+                notify_remote_via_irq(queue->tx_irq);
+}
+
 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
                                              u16      id,
                                              s8       st,