18 files changed, 135 insertions, 84 deletions

diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 3c82e02e3dae..b0f69248cb71 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -579,6 +579,10 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
         skb->pkt_type = PACKET_BROADCAST;
         skb->ip_summed = CHECKSUM_UNNECESSARY;
 
+        skb_reset_mac_header(skb);
+        skb_reset_network_header(skb);
+        skb_reset_transport_header(skb);
+
         can_skb_reserve(skb);
         can_skb_prv(skb)->ifindex = dev->ifindex;
 
@@ -603,6 +607,10 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
         skb->pkt_type = PACKET_BROADCAST;
         skb->ip_summed = CHECKSUM_UNNECESSARY;
 
+        skb_reset_mac_header(skb);
+        skb_reset_network_header(skb);
+        skb_reset_transport_header(skb);
+
         can_skb_reserve(skb);
         can_skb_prv(skb)->ifindex = dev->ifindex;
 
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 2928f7003041..a316fa4b91ab 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -14,6 +14,7 @@
  * Copyright (C) 2015 Valeo S.A.
  */
 
+#include <linux/kernel.h>
 #include <linux/completion.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
@@ -584,8 +585,15 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id,
                 while (pos <= actual_len - MSG_HEADER_LEN) {
                         tmp = buf + pos;
 
-                        if (!tmp->len)
-                                break;
+                        /* Handle messages crossing the USB endpoint max packet
+                         * size boundary. Check kvaser_usb_read_bulk_callback()
+                         * for further details.
+                         */
+                        if (tmp->len == 0) {
+                                pos = round_up(pos,
+                                               dev->bulk_in->wMaxPacketSize);
+                                continue;
+                        }
 
                         if (pos + tmp->len > actual_len) {
                                 dev_err(dev->udev->dev.parent,
@@ -787,7 +795,6 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
                 netdev_err(netdev, "Error transmitting URB\n");
                 usb_unanchor_urb(urb);
                 usb_free_urb(urb);
-                kfree(buf);
                 return err;
         }
 
@@ -1317,8 +1324,19 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
         while (pos <= urb->actual_length - MSG_HEADER_LEN) {
                 msg = urb->transfer_buffer + pos;
 
-                if (!msg->len)
-                        break;
+                /* The Kvaser firmware can only read and write messages that
+                 * does not cross the USB's endpoint wMaxPacketSize boundary.
+                 * If a follow-up command crosses such boundary, firmware puts
+                 * a placeholder zero-length command in its place then aligns
+                 * the real command to the next max packet size.
+                 *
+                 * Handle such cases or we're going to miss a significant
+                 * number of events in case of a heavy rx load on the bus.
+                 */
+                if (msg->len == 0) {
+                        pos = round_up(pos, dev->bulk_in->wMaxPacketSize);
+                        continue;
+                }
 
                 if (pos + msg->len > urb->actual_length) {
                         dev_err(dev->udev->dev.parent, "Format error\n");
@@ -1326,7 +1344,6 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
                 }
 
                 kvaser_usb_handle_message(dev, msg);
-
                 pos += msg->len;
         }
 
@@ -1615,8 +1632,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         struct urb *urb;
         void *buf;
         struct kvaser_msg *msg;
-        int i, err;
-        int ret = NETDEV_TX_OK;
+        int i, err, ret = NETDEV_TX_OK;
         u8 *msg_tx_can_flags = NULL;            /* GCC */
 
         if (can_dropped_invalid_skb(netdev, skb))
@@ -1634,7 +1650,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         if (!buf) {
                 stats->tx_dropped++;
                 dev_kfree_skb(skb);
-                goto nobufmem;
+                goto freeurb;
         }
 
         msg = buf;
@@ -1681,8 +1697,10 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         /* This should never happen; it implies a flow control bug */
         if (!context) {
                 netdev_warn(netdev, "cannot find free context\n");
+
+                kfree(buf);
                 ret =  NETDEV_TX_BUSY;
-                goto releasebuf;
+                goto freeurb;
         }
 
         context->priv = priv;
@@ -1719,16 +1737,12 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                 else
                         netdev_warn(netdev, "Failed tx_urb %d\n", err);
 
-                goto releasebuf;
+                goto freeurb;
         }
 
-        usb_free_urb(urb);
-
-        return NETDEV_TX_OK;
+        ret = NETDEV_TX_OK;
 
-releasebuf:
-        kfree(buf);
-nobufmem:
+freeurb:
         usb_free_urb(urb);
         return ret;
 }
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index 962c3f027383..0bac0f14edc3 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -879,6 +879,10 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev)
 
                 pdev->usb_if = ppdev->usb_if;
                 pdev->cmd_buffer_addr = ppdev->cmd_buffer_addr;
+
+                /* do a copy of the ctrlmode[_supported] too */
+                dev->can.ctrlmode = ppdev->dev.can.ctrlmode;
+                dev->can.ctrlmode_supported = ppdev->dev.can.ctrlmode_supported;
         }
 
         pdev->usb_if->dev[dev->ctrl_idx] = dev;
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index 869d97fcf781..b927021c6c40 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -593,7 +593,7 @@ static int xgene_enet_reset(struct xgene_enet_pdata *pdata)
         if (!xgene_ring_mgr_init(pdata))
                 return -ENODEV;
 
-        if (!efi_enabled(EFI_BOOT)) {
+        if (pdata->clk) {
                 clk_prepare_enable(pdata->clk);
                 clk_disable_unprepare(pdata->clk);
                 clk_prepare_enable(pdata->clk);
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 4de62b210c85..635a83be7e5e 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -1025,6 +1025,8 @@ static int xgene_enet_remove(struct platform_device *pdev)
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id xgene_enet_acpi_match[] = {
         { "APMC0D05", },
+        { "APMC0D30", },
+        { "APMC0D31", },
         { }
 };
 MODULE_DEVICE_TABLE(acpi, xgene_enet_acpi_match);
@@ -1033,6 +1035,8 @@ MODULE_DEVICE_TABLE(acpi, xgene_enet_acpi_match);
 #ifdef CONFIG_OF
 static struct of_device_id xgene_enet_of_match[] = {
         {.compatible = "apm,xgene-enet",},
+        {.compatible = "apm,xgene1-sgenet",},
+        {.compatible = "apm,xgene1-xgenet",},
         {},
 };
 
diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
index 21206d33b638..a7f2cc3e485e 100644
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -486,7 +486,7 @@ static int bcm_enet_poll(struct napi_struct *napi, int budget)
 {
         struct bcm_enet_priv *priv;
         struct net_device *dev;
-        int tx_work_done, rx_work_done;
+        int rx_work_done;
 
         priv = container_of(napi, struct bcm_enet_priv, napi);
         dev = priv->net_dev;
@@ -498,14 +498,14 @@ static int bcm_enet_poll(struct napi_struct *napi, int budget)
                          ENETDMAC_IR, priv->tx_chan);
 
         /* reclaim sent skb */
-        tx_work_done = bcm_enet_tx_reclaim(dev, 0);
+        bcm_enet_tx_reclaim(dev, 0);
 
         spin_lock(&priv->rx_lock);
         rx_work_done = bcm_enet_receive_queue(dev, budget);
         spin_unlock(&priv->rx_lock);
 
-        if (rx_work_done >= budget || tx_work_done > 0) {
-                /* rx/tx queue is not yet empty/clean */
+        if (rx_work_done >= budget) {
+                /* rx queue is not yet empty/clean */
                 return rx_work_done;
         }
 
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 676ffe093180..0469f72c6e7e 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -302,9 +302,6 @@ static int bgmac_dma_rx_skb_for_slot(struct bgmac *bgmac,
         slot->skb = skb;
         slot->dma_addr = dma_addr;
 
-        if (slot->dma_addr & 0xC0000000)
-                bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
-
         return 0;
 }
 
@@ -505,8 +502,6 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                                   ring->mmio_base);
                         goto err_dma_free;
                 }
-                if (ring->dma_base & 0xC0000000)
-                        bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
 
                 ring->unaligned = bgmac_dma_unaligned(bgmac, ring,
                                                       BGMAC_DMA_RING_TX);
@@ -536,8 +531,6 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                         err = -ENOMEM;
                         goto err_dma_free;
                 }
-                if (ring->dma_base & 0xC0000000)
-                        bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
 
                 ring->unaligned = bgmac_dma_unaligned(bgmac, ring,
                                                       BGMAC_DMA_RING_RX);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 7155e1d2c208..bef750a09027 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12722,6 +12722,9 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
         pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
                                PCICFG_VENDOR_ID_OFFSET);
 
+        /* Set PCIe reset type to fundamental for EEH recovery */
+        pdev->needs_freset = 1;
+
         /* AER (Advanced Error reporting) configuration */
         rc = pci_enable_pcie_error_reporting(pdev);
         if (!rc)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
index 149a0d70c108..b97122926d3a 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
@@ -73,15 +73,17 @@ int bcmgenet_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & ~(WAKE_MAGIC | WAKE_MAGICSECURE))
                 return -EINVAL;
 
+        reg = bcmgenet_umac_readl(priv, UMAC_MPD_CTRL);
         if (wol->wolopts & WAKE_MAGICSECURE) {
                 bcmgenet_umac_writel(priv, get_unaligned_be16(&wol->sopass[0]),
                                      UMAC_MPD_PW_MS);
                 bcmgenet_umac_writel(priv, get_unaligned_be32(&wol->sopass[2]),
                                      UMAC_MPD_PW_LS);
-                reg = bcmgenet_umac_readl(priv, UMAC_MPD_CTRL);
                 reg |= MPD_PW_EN;
-                bcmgenet_umac_writel(priv, reg, UMAC_MPD_CTRL);
+        } else {
+                reg &= ~MPD_PW_EN;
         }
+        bcmgenet_umac_writel(priv, reg, UMAC_MPD_CTRL);
 
         /* Flag the device and relevant IRQ as wakeup capable */
         if (wol->wolopts) {
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index ad76b8e35a00..81d41539fcba 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -2113,17 +2113,17 @@ static const struct net_device_ops macb_netdev_ops = {
 };
 
 #if defined(CONFIG_OF)
-static struct macb_config pc302gem_config = {
+static const struct macb_config pc302gem_config = {
         .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE,
         .dma_burst_length = 16,
 };
 
-static struct macb_config sama5d3_config = {
+static const struct macb_config sama5d3_config = {
         .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE,
         .dma_burst_length = 16,
 };
 
-static struct macb_config sama5d4_config = {
+static const struct macb_config sama5d4_config = {
         .caps = 0,
         .dma_burst_length = 4,
 };
@@ -2154,7 +2154,7 @@ static void macb_configure_caps(struct macb *bp)
         if (bp->pdev->dev.of_node) {
                 match = of_match_node(macb_dt_ids, bp->pdev->dev.of_node);
                 if (match && match->data) {
-                        config = (const struct macb_config *)match->data;
+                        config = match->data;
 
                         bp->caps = config->caps;
                         /*
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 31dc080f2437..ff85619a9732 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -351,7 +351,7 @@
 
 /* Bitfields in MID */
 #define MACB_IDNUM_OFFSET                       16
-#define MACB_IDNUM_SIZE                         16
+#define MACB_IDNUM_SIZE                         12
 #define MACB_REV_OFFSET                         0
 #define MACB_REV_SIZE                           16
 
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 9bb6220663b2..99492b7e3713 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1597,7 +1597,7 @@ fec_enet_interrupt(int irq, void *dev_id)
         writel(int_events, fep->hwp + FEC_IEVENT);
         fec_enet_collect_events(fep, int_events);
 
-        if (fep->work_tx || fep->work_rx) {
+        if ((fep->work_tx || fep->work_rx) && fep->link) {
                 ret = IRQ_HANDLED;
 
                 if (napi_schedule_prep(&fep->napi)) {
@@ -3383,7 +3383,6 @@ fec_drv_remove(struct platform_device *pdev)
                 regulator_disable(fep->reg_phy);
         if (fep->ptp_clock)
                 ptp_clock_unregister(fep->ptp_clock);
-        fec_enet_clk_enable(ndev, false);
         of_node_put(fep->phy_node);
         free_netdev(ndev);
 
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 178e54028d10..7bf3682cdf47 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -747,6 +747,18 @@ static int gfar_parse_group(struct device_node *np,
         return 0;
 }
 
+static int gfar_of_group_count(struct device_node *np)
+{
+        struct device_node *child;
+        int num = 0;
+
+        for_each_available_child_of_node(np, child)
+                if (!of_node_cmp(child->name, "queue-group"))
+                        num++;
+
+        return num;
+}
+
 static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
 {
         const char *model;
@@ -784,7 +796,7 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
                 num_rx_qs = 1;
         } else { /* MQ_MG_MODE */
                 /* get the actual number of supported groups */
-                unsigned int num_grps = of_get_available_child_count(np);
+                unsigned int num_grps = gfar_of_group_count(np);
 
                 if (num_grps == 0 || num_grps > MAXGROUPS) {
                         dev_err(&ofdev->dev, "Invalid # of int groups(%d)\n",
@@ -851,7 +863,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
 
         /* Parse and initialize group specific information */
         if (priv->mode == MQ_MG_MODE) {
-                for_each_child_of_node(np, child) {
+                for_each_available_child_of_node(np, child) {
+                        if (of_node_cmp(child->name, "queue-group"))
+                                continue;
+
                         err = gfar_parse_group(child, priv, model);
                         if (err)
                                 goto err_grp_init;
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 209ee1b27f8d..5d093dc0f5f5 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -92,6 +92,7 @@ static const char version[] =
 #include "smc91x.h"
 
 #if defined(CONFIG_ASSABET_NEPONSET)
+#include <mach/assabet.h>
 #include <mach/neponset.h>
 #endif
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index fb846ebba1d9..f9b42f11950f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -272,6 +272,37 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
         struct stmmac_priv *priv = NULL;
         struct plat_stmmacenet_data *plat_dat = NULL;
         const char *mac = NULL;
+        int irq, wol_irq, lpi_irq;
+
+        /* Get IRQ information early to have an ability to ask for deferred
+         * probe if needed before we went too far with resource allocation.
+         */
+        irq = platform_get_irq_byname(pdev, "macirq");
+        if (irq < 0) {
+                if (irq != -EPROBE_DEFER) {
+                        dev_err(dev,
+                                "MAC IRQ configuration information not found\n");
+                }
+                return irq;
+        }
+
+        /* On some platforms e.g. SPEAr the wake up irq differs from the mac irq
+         * The external wake up irq can be passed through the platform code
+         * named as "eth_wake_irq"
+         *
+         * In case the wake up interrupt is not passed from the platform
+         * so the driver will continue to use the mac irq (ndev->irq)
+         */
+        wol_irq = platform_get_irq_byname(pdev, "eth_wake_irq");
+        if (wol_irq < 0) {
+                if (wol_irq == -EPROBE_DEFER)
+                        return -EPROBE_DEFER;
+                wol_irq = irq;
+        }
+
+        lpi_irq = platform_get_irq_byname(pdev, "eth_lpi");
+        if (lpi_irq == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         addr = devm_ioremap_resource(dev, res);
@@ -323,39 +354,15 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
                 return PTR_ERR(priv);
         }
 
+        /* Copy IRQ values to priv structure which is now avaialble */
+        priv->dev->irq = irq;
+        priv->wol_irq = wol_irq;
+        priv->lpi_irq = lpi_irq;
+
         /* Get MAC address if available (DT) */
         if (mac)
                 memcpy(priv->dev->dev_addr, mac, ETH_ALEN);
 
-        /* Get the MAC information */
-        priv->dev->irq = platform_get_irq_byname(pdev, "macirq");
-        if (priv->dev->irq < 0) {
-                if (priv->dev->irq != -EPROBE_DEFER) {
-                        netdev_err(priv->dev,
-                                   "MAC IRQ configuration information not found\n");
-                }
-                return priv->dev->irq;
-        }
-
-        /*
-         * On some platforms e.g. SPEAr the wake up irq differs from the mac irq
-         * The external wake up irq can be passed through the platform code
-         * named as "eth_wake_irq"
-         *
-         * In case the wake up interrupt is not passed from the platform
-         * so the driver will continue to use the mac irq (ndev->irq)
-         */
-        priv->wol_irq = platform_get_irq_byname(pdev, "eth_wake_irq");
-        if (priv->wol_irq < 0) {
-                if (priv->wol_irq == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-                priv->wol_irq = priv->dev->irq;
-        }
-
-        priv->lpi_irq = platform_get_irq_byname(pdev, "eth_lpi");
-        if (priv->lpi_irq == -EPROBE_DEFER)
-                return -EPROBE_DEFER;
-
         platform_set_drvdata(pdev, priv->dev);
 
         pr_debug("STMMAC platform driver registration completed");
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index f1ee71e22241..7d394846afc2 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1730,11 +1730,11 @@ static int team_set_mac_address(struct net_device *dev, void *p)
         if (dev->type == ARPHRD_ETHER && !is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
         memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
-        rcu_read_lock();
-        list_for_each_entry_rcu(port, &team->port_list, list)
+        mutex_lock(&team->lock);
+        list_for_each_entry(port, &team->port_list, list)
                 if (team->ops.port_change_dev_addr)
                         team->ops.port_change_dev_addr(team, port);
-        rcu_read_unlock();
+        mutex_unlock(&team->lock);
         return 0;
 }
 
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index f38227afe099..3aa8648080c8 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -340,12 +340,11 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
         unsigned int num_queues = vif->num_queues;
         int i;
         unsigned int queue_index;
-        struct xenvif_stats *vif_stats;
 
         for (i = 0; i < ARRAY_SIZE(xenvif_stats); i++) {
                 unsigned long accum = 0;
                 for (queue_index = 0; queue_index < num_queues; ++queue_index) {
-                        vif_stats = &vif->queues[queue_index].stats;
+                        void *vif_stats = &vif->queues[queue_index].stats;
                         accum += *(unsigned long *)(vif_stats + xenvif_stats[i].offset);
                 }
                 data[i] = accum;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index c4d68d768408..cab9f5257f57 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1349,7 +1349,7 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s
 {
         unsigned int offset = skb_headlen(skb);
         skb_frag_t frags[MAX_SKB_FRAGS];
-        int i;
+        int i, f;
         struct ubuf_info *uarg;
         struct sk_buff *nskb = skb_shinfo(skb)->frag_list;
 
@@ -1389,23 +1389,25 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s
                 frags[i].page_offset = 0;
                 skb_frag_size_set(&frags[i], len);
         }
-        /* swap out with old one */
-        memcpy(skb_shinfo(skb)->frags,
-               frags,
-               i * sizeof(skb_frag_t));
-        skb_shinfo(skb)->nr_frags = i;
-        skb->truesize += i * PAGE_SIZE;
 
-        /* remove traces of mapped pages and frag_list */
+        /* Copied all the bits from the frag list -- free it. */
         skb_frag_list_init(skb);
+        xenvif_skb_zerocopy_prepare(queue, nskb);
+        kfree_skb(nskb);
+
+        /* Release all the original (foreign) frags. */
+        for (f = 0; f < skb_shinfo(skb)->nr_frags; f++)
+                skb_frag_unref(skb, f);
         uarg = skb_shinfo(skb)->destructor_arg;
         /* increase inflight counter to offset decrement in callback */
         atomic_inc(&queue->inflight_packets);
         uarg->callback(uarg, true);
         skb_shinfo(skb)->destructor_arg = NULL;
 
-        xenvif_skb_zerocopy_prepare(queue, nskb);
-        kfree_skb(nskb);
+        /* Fill the skb with the new (local) frags. */
+        memcpy(skb_shinfo(skb)->frags, frags, i * sizeof(skb_frag_t));
+        skb_shinfo(skb)->nr_frags = i;
+        skb->truesize += i * PAGE_SIZE;
 
         return 0;
 }