On Sat, 2014-03-29 at 18:52 -0400, David Miller wrote:

From: Ian Campbell <redacted>
Date: Fri, 28 Mar 2014 12:58:47 +0000

quoted

On Fri, 2014-03-28 at 13:45 +0100, Sander Eikelenboom wrote:

quoted

Friday, March 28, 2014, 12:39:05 PM, you wrote:

quoted

This patch removes a test in start_new_rx_buffer() that checks whether
a copy operation is less than MAX_BUFFER_OFFSET in length, since
MAX_BUFFER_OFFSET is defined to be PAGE_SIZE and the only caller of
start_new_rx_buffer() already limits copy operations to PAGE_SIZE or less.

quoted

Signed-off-by: Paul Durrant <redacted>
Cc: Ian Campbell <redacted>
Cc: Wei Liu <redacted>
Cc: Sander Eikelenboom <redacted>
---
 drivers/net/xen-netback/netback.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

quoted

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 438d0c0..72314c7 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c

@@ -192,8 +192,8 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head)
         * into multiple copies tend to give large frags their
         * own buffers as before.
         */
-       if ((offset + size > MAX_BUFFER_OFFSET) &&
-           (size <= MAX_BUFFER_OFFSET) && offset && !head)
+       BUG_ON(size > MAX_BUFFER_OFFSET);
+       if ((offset + size > MAX_BUFFER_OFFSET) && offset && !head)
                return true;
 
        return false;

For the whole v3 series:

Reported-By: Sander Eikelenboom <redacted>
Tested-By: Sander Eikelenboom <redacted>

CC'ed Dave to get his attention since this is a last minute for 3.14.

All three patches: Acked-by: Ian Campbell [off-list ref]

Ok, we're coming down to the wire so this might not make it, but
I'll queue it up for -stable and get it merged when I can.

Thanks!