3 files changed, 40 insertions, 11 deletions

diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 08ae01b41c83..c47794b9d42f 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -101,6 +101,13 @@ struct xenvif_rx_meta {
 
 #define MAX_PENDING_REQS 256
 
+/* It's possible for an skb to have a maximal number of frags
+ * but still be less than MAX_BUFFER_OFFSET in size. Thus the
+ * worst-case number of copy operations is MAX_SKB_FRAGS per
+ * ring slot.
+ */
+#define MAX_GRANT_COPY_OPS (MAX_SKB_FRAGS * XEN_NETIF_RX_RING_SIZE)
+
 struct xenvif {
         /* Unique identifier for this interface. */
         domid_t          domid;
@@ -143,13 +150,13 @@ struct xenvif {
          */
         RING_IDX rx_req_cons_peek;
 
-        /* Given MAX_BUFFER_OFFSET of 4096 the worst case is that each
-         * head/fragment page uses 2 copy operations because it
-         * straddles two buffers in the frontend.
-         */
-        struct gnttab_copy grant_copy_op[2*XEN_NETIF_RX_RING_SIZE];
-        struct xenvif_rx_meta meta[2*XEN_NETIF_RX_RING_SIZE];
+        /* This array is allocated seperately as it is large */
+        struct gnttab_copy *grant_copy_op;
 
+        /* We create one meta structure per ring request we consume, so
+         * the maximum number is the same as the ring size.
+         */
+        struct xenvif_rx_meta meta[XEN_NETIF_RX_RING_SIZE];
 
         u8               fe_dev_addr[6];
 
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 870f1fa58370..fff8cddfed81 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -34,6 +34,7 @@
 #include <linux/ethtool.h>
 #include <linux/rtnetlink.h>
 #include <linux/if_vlan.h>
+#include <linux/vmalloc.h>
 
 #include <xen/events.h>
 #include <asm/xen/hypercall.h>
@@ -307,6 +308,15 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         SET_NETDEV_DEV(dev, parent);
 
         vif = netdev_priv(dev);
+
+        vif->grant_copy_op = vmalloc(sizeof(struct gnttab_copy) *
+                                     MAX_GRANT_COPY_OPS);
+        if (vif->grant_copy_op == NULL) {
+                pr_warn("Could not allocate grant copy space for %s\n", name);
+                free_netdev(dev);
+                return ERR_PTR(-ENOMEM);
+        }
+
         vif->domid  = domid;
         vif->handle = handle;
         vif->can_sg = 1;
@@ -487,6 +497,7 @@ void xenvif_free(struct xenvif *vif)
 
         unregister_netdev(vif->dev);
 
+        vfree(vif->grant_copy_op);
         free_netdev(vif->dev);
 
         module_put(THIS_MODULE);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index e884ee1fe7ed..78425554a537 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -608,7 +608,7 @@ void xenvif_rx_action(struct xenvif *vif)
         if (!npo.copy_prod)
                 return;
 
-        BUG_ON(npo.copy_prod > ARRAY_SIZE(vif->grant_copy_op));
+        BUG_ON(npo.copy_prod > MAX_GRANT_COPY_OPS);
         gnttab_batch_copy(vif->grant_copy_op, npo.copy_prod);
 
         while ((skb = __skb_dequeue(&rxq)) != NULL) {
@@ -1197,6 +1197,9 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
 
         err = -EPROTO;
 
+        if (fragment)
+                goto out;
+
         switch (ip_hdr(skb)->protocol) {
         case IPPROTO_TCP:
                 err = maybe_pull_tail(skb,
@@ -1206,8 +1209,10 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
                         goto out;
 
                 if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct tcphdr, check)))
+                                          offsetof(struct tcphdr, check))) {
+                        err = -EPROTO;
                         goto out;
+                }
 
                 if (recalculate_partial_csum)
                         tcp_hdr(skb)->check =
@@ -1224,8 +1229,10 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
                         goto out;
 
                 if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct udphdr, check)))
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
                         goto out;
+                }
 
                 if (recalculate_partial_csum)
                         udp_hdr(skb)->check =
@@ -1347,8 +1354,10 @@ static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
                         goto out;
 
                 if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct tcphdr, check)))
+                                          offsetof(struct tcphdr, check))) {
+                        err = -EPROTO;
                         goto out;
+                }
 
                 if (recalculate_partial_csum)
                         tcp_hdr(skb)->check =
@@ -1365,8 +1374,10 @@ static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
                         goto out;
 
                 if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct udphdr, check)))
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
                         goto out;
+                }
 
                 if (recalculate_partial_csum)
                         udp_hdr(skb)->check =