16 files changed, 96 insertions, 54 deletions

diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 001c66dd3a94..a8c0f436cdd2 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -1555,6 +1555,7 @@ vortex_up(struct net_device *dev)
                 mii_reg1 = mdio_read(dev, vp->phys[0], MII_BMSR);
                 mii_reg5 = mdio_read(dev, vp->phys[0], MII_LPA);
                 vp->partner_flow_ctrl = ((mii_reg5 & 0x0400) != 0);
+                vp->mii.full_duplex = vp->full_duplex;
 
                 vortex_check_media(dev, 1);
         }
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 81ef81c9a584..5b9e17bf1749 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1968,6 +1968,16 @@ menuconfig NETDEV_1000
         bool "Ethernet (1000 Mbit)"
         depends on !UML
         default y
+        ---help---
+          Ethernet (also called IEEE 802.3 or ISO 8802-2) is the most common
+          type of Local Area Network (LAN) in universities and companies.
+
+          Say Y here to get to see options for Gigabit Ethernet drivers.
+          This option alone does not add any kernel code.
+          Note that drivers supporting both 100 and 1000 MBit may be listed
+          under "Ethernet (10 or 100MBit)" instead.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if NETDEV_1000
 
@@ -2339,6 +2349,11 @@ menuconfig NETDEV_10000
         bool "Ethernet (10000 Mbit)"
         depends on !UML
         default y
+        ---help---
+          Say Y here to get to see options for 10 Gigabit Ethernet drivers.
+          This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if NETDEV_10000
 
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index 83da1770bafb..90e0734e6037 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -821,8 +821,9 @@ static int ax_probe(struct platform_device *pdev)
         dev->base_addr = (unsigned long)ei_status.mem;
 
         if (ei_status.mem == NULL) {
-                dev_err(&pdev->dev, "Cannot ioremap area (%08zx,%08zx)\n",
-                        res->start, res->end);
+                dev_err(&pdev->dev, "Cannot ioremap area (%08llx,%08llx)\n",
+                        (unsigned long long)res->start,
+                        (unsigned long long)res->end);
 
                 ret = -ENXIO;
                 goto exit_req;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 070b78d959cc..1afda3230def 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1202,43 +1202,35 @@ static int bond_sethwaddr(struct net_device *bond_dev,
         return 0;
 }
 
-#define BOND_INTERSECT_FEATURES \
-        (NETIF_F_SG | NETIF_F_ALL_CSUM | NETIF_F_TSO | NETIF_F_UFO)
+#define BOND_VLAN_FEATURES \
+        (NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX | \
+         NETIF_F_HW_VLAN_FILTER)
 
 /* 
  * Compute the common dev->feature set available to all slaves.  Some
- * feature bits are managed elsewhere, so preserve feature bits set on
- * master device that are not part of the examined set.
+ * feature bits are managed elsewhere, so preserve those feature bits
+ * on the master device.
  */
 static int bond_compute_features(struct bonding *bond)
 {
-        unsigned long features = BOND_INTERSECT_FEATURES;
         struct slave *slave;
         struct net_device *bond_dev = bond->dev;
+        unsigned long features = bond_dev->features;
         unsigned short max_hard_header_len = ETH_HLEN;
         int i;
 
+        features &= ~(NETIF_F_ALL_CSUM | BOND_VLAN_FEATURES);
+        features |= NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
+                    NETIF_F_GSO_MASK | NETIF_F_NO_CSUM;
+
         bond_for_each_slave(bond, slave, i) {
-                features &= (slave->dev->features & BOND_INTERSECT_FEATURES);
+                features = netdev_compute_features(features,
+                                                   slave->dev->features);
                 if (slave->dev->hard_header_len > max_hard_header_len)
                         max_hard_header_len = slave->dev->hard_header_len;
         }
 
-        if ((features & NETIF_F_SG) && 
-            !(features & NETIF_F_ALL_CSUM))
-                features &= ~NETIF_F_SG;
-
-        /* 
-         * features will include NETIF_F_TSO (NETIF_F_UFO) iff all 
-         * slave devices support NETIF_F_TSO (NETIF_F_UFO), which 
-         * implies that all slaves also support scatter-gather 
-         * (NETIF_F_SG), which implies that features also includes 
-         * NETIF_F_SG. So no need to check whether we have an  
-         * illegal combination of NETIF_F_{TSO,UFO} and 
-         * !NETIF_F_SG 
-         */
-
-        features |= (bond_dev->features & ~BOND_INTERSECT_FEATURES);
+        features |= (bond_dev->features & BOND_VLAN_FEATURES);
         bond_dev->features = features;
         bond_dev->hard_header_len = max_hard_header_len;
 
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index c90c92e72d2a..4c3785c9d4b8 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -1706,6 +1706,7 @@ static int e1000_wol_exclusion(struct e1000_adapter *adapter, struct ethtool_wol
         case E1000_DEV_ID_82545EM_COPPER:
         case E1000_DEV_ID_82546GB_QUAD_COPPER:
         case E1000_DEV_ID_82546GB_PCIE:
+        case E1000_DEV_ID_82571EB_SERDES_QUAD:
                 /* these don't support WoL at all */
                 wol->supported = 0;
                 break;
@@ -1723,6 +1724,7 @@ static int e1000_wol_exclusion(struct e1000_adapter *adapter, struct ethtool_wol
                 retval = 0;
                 break;
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
+        case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
         case E1000_DEV_ID_82546GB_QUAD_COPPER_KSP3:
                 /* quad port adapters only support WoL on port A */
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index 9be44699300b..ba120f7fb0be 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -384,7 +384,10 @@ e1000_set_mac_type(struct e1000_hw *hw)
         case E1000_DEV_ID_82571EB_COPPER:
         case E1000_DEV_ID_82571EB_FIBER:
         case E1000_DEV_ID_82571EB_SERDES:
+        case E1000_DEV_ID_82571EB_SERDES_DUAL:
+        case E1000_DEV_ID_82571EB_SERDES_QUAD:
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
+        case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
                 hw->mac_type = e1000_82571;
                 break;
@@ -485,6 +488,8 @@ e1000_set_media_type(struct e1000_hw *hw)
     case E1000_DEV_ID_82545GM_SERDES:
     case E1000_DEV_ID_82546GB_SERDES:
     case E1000_DEV_ID_82571EB_SERDES:
+    case E1000_DEV_ID_82571EB_SERDES_DUAL:
+    case E1000_DEV_ID_82571EB_SERDES_QUAD:
     case E1000_DEV_ID_82572EI_SERDES:
     case E1000_DEV_ID_80003ES2LAN_SERDES_DPT:
         hw->media_type = e1000_media_type_internal_serdes;
diff --git a/drivers/net/e1000/e1000_hw.h b/drivers/net/e1000/e1000_hw.h
index bd000b802ee7..fe8714655c90 100644
--- a/drivers/net/e1000/e1000_hw.h
+++ b/drivers/net/e1000/e1000_hw.h
@@ -475,7 +475,10 @@ int32_t e1000_check_phy_reset_block(struct e1000_hw *hw);
 #define E1000_DEV_ID_82571EB_FIBER       0x105F
 #define E1000_DEV_ID_82571EB_SERDES      0x1060
 #define E1000_DEV_ID_82571EB_QUAD_COPPER 0x10A4
+#define E1000_DEV_ID_82571EB_QUAD_FIBER  0x10A5
 #define E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE  0x10BC
+#define E1000_DEV_ID_82571EB_SERDES_DUAL 0x10D9
+#define E1000_DEV_ID_82571EB_SERDES_QUAD 0x10DA
 #define E1000_DEV_ID_82572EI_COPPER      0x107D
 #define E1000_DEV_ID_82572EI_FIBER       0x107E
 #define E1000_DEV_ID_82572EI_SERDES      0x107F
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index f48b659e0c2b..4a225950fb43 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -100,6 +100,7 @@ static struct pci_device_id e1000_pci_tbl[] = {
         INTEL_E1000_ETHERNET_DEVICE(0x1099),
         INTEL_E1000_ETHERNET_DEVICE(0x109A),
         INTEL_E1000_ETHERNET_DEVICE(0x10A4),
+        INTEL_E1000_ETHERNET_DEVICE(0x10A5),
         INTEL_E1000_ETHERNET_DEVICE(0x10B5),
         INTEL_E1000_ETHERNET_DEVICE(0x10B9),
         INTEL_E1000_ETHERNET_DEVICE(0x10BA),
@@ -107,6 +108,8 @@ static struct pci_device_id e1000_pci_tbl[] = {
         INTEL_E1000_ETHERNET_DEVICE(0x10BC),
         INTEL_E1000_ETHERNET_DEVICE(0x10C4),
         INTEL_E1000_ETHERNET_DEVICE(0x10C5),
+        INTEL_E1000_ETHERNET_DEVICE(0x10D9),
+        INTEL_E1000_ETHERNET_DEVICE(0x10DA),
         /* required last entry */
         {0,}
 };
@@ -1096,6 +1099,7 @@ e1000_probe(struct pci_dev *pdev,
                 break;
         case E1000_DEV_ID_82546GB_QUAD_COPPER_KSP3:
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
+        case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
                 /* if quad port adapter, disable WoL on all but port A */
                 if (global_quad_port_a != 0)
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 69f5f365239a..10f4e3b55168 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -3068,8 +3068,8 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
                                 np->nic_poll_irq = np->irqmask;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         spin_unlock(&np->lock);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         break;
                 }
 
@@ -3186,8 +3186,8 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
                                 np->nic_poll_irq = np->irqmask;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         spin_unlock(&np->lock);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         break;
                 }
 
@@ -3233,8 +3233,8 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
                                 np->nic_poll_irq |= NVREG_IRQ_TX_ALL;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
                         spin_unlock_irqrestore(&np->lock, flags);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
                         break;
                 }
 
@@ -3348,8 +3348,8 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
                                 np->nic_poll_irq |= NVREG_IRQ_RX_ALL;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
                         spin_unlock_irqrestore(&np->lock, flags);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
                         break;
                 }
         }
@@ -3421,8 +3421,8 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
                                 np->nic_poll_irq |= NVREG_IRQ_OTHER;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
                         spin_unlock_irqrestore(&np->lock, flags);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
                         break;
                 }
 
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 0ac240ca905b..3b0fd83fa266 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1561,10 +1561,9 @@ static inline struct irda_class_desc *irda_usb_find_class_desc(struct usb_interf
         struct irda_class_desc *desc;
         int ret;
 
-        desc = kmalloc(sizeof (*desc), GFP_KERNEL);
-        if (desc == NULL) 
+        desc = kzalloc(sizeof(*desc), GFP_KERNEL);
+        if (!desc)
                 return NULL;
-        memset(desc, 0, sizeof(*desc));
 
         /* USB-IrDA class spec 1.0:
          *      6.1.3: Standard "Get Descriptor" Device Request is not
@@ -1617,7 +1616,7 @@ static int irda_usb_probe(struct usb_interface *intf,
 {
         struct net_device *net;
         struct usb_device *dev = interface_to_usbdev(intf);
-        struct irda_usb_cb *self = NULL;
+        struct irda_usb_cb *self;
         struct usb_host_interface *interface;
         struct irda_class_desc *irda_desc;
         int ret = -ENOMEM;
@@ -1655,7 +1654,7 @@ static int irda_usb_probe(struct usb_interface *intf,
                 self->header_length = USB_IRDA_HEADER;
         }
 
-        self->rx_urb = kzalloc(self->max_rx_urb * sizeof(struct urb *),
+        self->rx_urb = kcalloc(self->max_rx_urb, sizeof(struct urb *),
                                 GFP_KERNEL);
 
         for (i = 0; i < self->max_rx_urb; i++) {
@@ -1715,7 +1714,7 @@ static int irda_usb_probe(struct usb_interface *intf,
         /* Find IrDA class descriptor */
         irda_desc = irda_usb_find_class_desc(intf);
         ret = -ENODEV;
-        if (irda_desc == NULL)
+        if (!irda_desc)
                 goto err_out_3;
 
         if (self->needspatch) {
@@ -1738,15 +1737,13 @@ static int irda_usb_probe(struct usb_interface *intf,
         /* Don't change this buffer size and allocation without doing
          * some heavy and complete testing. Don't ask why :-(
          * Jean II */
-        self->speed_buff = kmalloc(IRDA_USB_SPEED_MTU, GFP_KERNEL);
-        if (self->speed_buff == NULL) 
+        self->speed_buff = kzalloc(IRDA_USB_SPEED_MTU, GFP_KERNEL);
+        if (!self->speed_buff)
                 goto err_out_3;
 
-        memset(self->speed_buff, 0, IRDA_USB_SPEED_MTU);
-
         self->tx_buff = kzalloc(IRDA_SKB_MAX_MTU + self->header_length,
                                 GFP_KERNEL);
-        if (self->tx_buff == NULL)
+        if (!self->tx_buff)
                 goto err_out_4;
 
         ret = irda_usb_open(self);
@@ -1767,12 +1764,11 @@ static int irda_usb_probe(struct usb_interface *intf,
 
                 /* replace IrDA class descriptor with what patched device is now reporting */
                 irda_desc = irda_usb_find_class_desc (self->usbintf);
-                if (irda_desc == NULL) {
+                if (!irda_desc) {
                         ret = -ENODEV;
                         goto err_out_6;
                 }
-                if (self->irda_desc)
-                        kfree (self->irda_desc);
+                kfree(self->irda_desc);
                 self->irda_desc = irda_desc;
                 irda_usb_init_qos(self);
         }
diff --git a/drivers/net/mlx4/reset.c b/drivers/net/mlx4/reset.c
index e4dfd4b11a4a..e199715fabd0 100644
--- a/drivers/net/mlx4/reset.c
+++ b/drivers/net/mlx4/reset.c
@@ -119,6 +119,9 @@ int mlx4_reset(struct mlx4_dev *dev)
         writel(MLX4_RESET_VALUE, reset + MLX4_RESET_OFFSET);
         iounmap(reset);
 
+        /* Docs say to wait one second before accessing device */
+        msleep(1000);
+
         end = jiffies + MLX4_RESET_TIMEOUT_JIFFIES;
         do {
                 if (!pci_read_config_word(dev->pdev, PCI_VENDOR_ID, &vendor) &&
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index deca65330b0f..ae9bb7b7fd67 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -191,6 +191,7 @@ struct myri10ge_priv {
         struct timer_list watchdog_timer;
         int watchdog_tx_done;
         int watchdog_tx_req;
+        int watchdog_pause;
         int watchdog_resets;
         int tx_linearized;
         int pause;
@@ -2800,6 +2801,7 @@ static void myri10ge_watchdog(struct work_struct *work)
 static void myri10ge_watchdog_timer(unsigned long arg)
 {
         struct myri10ge_priv *mgp;
+        u32 rx_pause_cnt;
 
         mgp = (struct myri10ge_priv *)arg;
 
@@ -2816,19 +2818,28 @@ static void myri10ge_watchdog_timer(unsigned long arg)
                     myri10ge_fill_thresh)
                         mgp->rx_big.watchdog_needed = 0;
         }
+        rx_pause_cnt = ntohl(mgp->fw_stats->dropped_pause);
 
         if (mgp->tx.req != mgp->tx.done &&
             mgp->tx.done == mgp->watchdog_tx_done &&
-            mgp->watchdog_tx_req != mgp->watchdog_tx_done)
+            mgp->watchdog_tx_req != mgp->watchdog_tx_done) {
                 /* nic seems like it might be stuck.. */
-                schedule_work(&mgp->watchdog_work);
-        else
-                /* rearm timer */
-                mod_timer(&mgp->watchdog_timer,
-                          jiffies + myri10ge_watchdog_timeout * HZ);
-
+                if (rx_pause_cnt != mgp->watchdog_pause) {
+                        if (net_ratelimit())
+                                printk(KERN_WARNING "myri10ge %s:"
+                                       "TX paused, check link partner\n",
+                                       mgp->dev->name);
+                } else {
+                        schedule_work(&mgp->watchdog_work);
+                        return;
+                }
+        }
+        /* rearm timer */
+        mod_timer(&mgp->watchdog_timer,
+                  jiffies + myri10ge_watchdog_timeout * HZ);
         mgp->watchdog_tx_done = mgp->tx.done;
         mgp->watchdog_tx_req = mgp->tx.req;
+        mgp->watchdog_pause = rx_pause_cnt;
 }
 
 static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index 6bb48ba80964..b47a12d684f9 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -2438,13 +2438,16 @@ static void netdev_error(struct net_device *dev, int intr_status)
                                 dev->name);
                 }
                 np->stats.rx_fifo_errors++;
+                np->stats.rx_errors++;
         }
         /* Hmmmmm, it's not clear how to recover from PCI faults. */
         if (intr_status & IntrPCIErr) {
                 printk(KERN_NOTICE "%s: PCI error %#08x\n", dev->name,
                         intr_status & IntrPCIErr);
                 np->stats.tx_fifo_errors++;
+                np->stats.tx_errors++;
                 np->stats.rx_fifo_errors++;
+                np->stats.rx_errors++;
         }
         spin_unlock(&np->lock);
 }
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index c3fe230695a0..b56dff26772d 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -42,7 +42,13 @@ static int max_interrupt_work = 20;
 
 /* Set the copy breakpoint for the copy-only-tiny-frames scheme.
    Setting to > 1518 effectively disables this feature. */
+#if defined(__alpha__) || defined(__arm__) || defined(__hppa__) \
+       || defined(CONFIG_SPARC) || defined(__ia64__) \
+       || defined(__sh__) || defined(__mips__)
+static int rx_copybreak = 1518;
+#else
 static int rx_copybreak;
+#endif
 
 /* Work-around for broken BIOSes: they are unable to get the chip back out of
    power state D3 so PXE booting fails. bootparam(7): via-rhine.avoid_D3=1 */
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index 15b6e07a4382..071a64cacd5c 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -212,14 +212,13 @@ static pvc_device* add_pvc(struct net_device *dev, u16 dlci)
                 pvc_p = &(*pvc_p)->next;
         }
 
-        pvc = kmalloc(sizeof(pvc_device), GFP_ATOMIC);
+        pvc = kzalloc(sizeof(pvc_device), GFP_ATOMIC);
 #ifdef DEBUG_PVC
         printk(KERN_DEBUG "add_pvc: allocated pvc %p, frad %p\n", pvc, dev);
 #endif
         if (!pvc)
                 return NULL;
 
-        memset(pvc, 0, sizeof(pvc_device));
         pvc->dlci = dlci;
         pvc->frad = dev;
         pvc->next = *pvc_p;     /* Put it in the chain */
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 489f69c5d6ca..4445810335a8 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -566,6 +566,10 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (notify)
                 notify_remote_via_irq(np->netdev->irq);
 
+        np->stats.tx_bytes += skb->len;
+        np->stats.tx_packets++;
+
+        /* Note: It is not safe to access skb after xennet_tx_buf_gc()! */
         xennet_tx_buf_gc(dev);
 
         if (!netfront_tx_slot_available(np))
@@ -573,9 +577,6 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         spin_unlock_irq(&np->tx_lock);
 
-        np->stats.tx_bytes += skb->len;
-        np->stats.tx_packets++;
-
         return 0;
 
  drop: