1.1 --- a/xen/net/dev.c	Mon Feb 09 13:59:17 2004 +0000
     1.2 +++ b/xen/net/dev.c	Mon Feb 09 14:39:34 2004 +0000
     1.3 @@ -2100,6 +2100,7 @@ static void get_rx_bufs(net_vif_t *vif)
     1.4              if ( cmpxchg(ptep, pte & ~_PAGE_PRESENT, pte) != 
     1.5                   (pte & ~_PAGE_PRESENT) )
     1.6                  put_page_and_type(buf_page);
     1.7 +            put_page_and_type(pte_page);
     1.8              make_rx_response(vif, rx.id, 0, RING_STATUS_BAD_PAGE, 0);
     1.9              goto rx_unmap_and_continue;
    1.10          }
    1.11 @@ -2115,10 +2116,12 @@ static void get_rx_bufs(net_vif_t *vif)
    1.12          {
    1.13              DPRINTK("Page held more than once %08lx\n", 
    1.14                      buf_page->count_and_flags);
    1.15 -            if ( get_page_type(buf_page, PGT_writeable_page) &&
    1.16 -                 (cmpxchg(ptep, pte & ~_PAGE_PRESENT, pte) !=
    1.17 -                  (pte & ~_PAGE_PRESENT)) )
    1.18 +            if ( !get_page_type(buf_page, PGT_writeable_page) )
    1.19 +                put_page(buf_page);
    1.20 +            else if ( cmpxchg(ptep, pte & ~_PAGE_PRESENT, pte) !=
    1.21 +                      (pte & ~_PAGE_PRESENT) )
    1.22                  put_page_and_type(buf_page);
    1.23 +            put_page_and_type(pte_page);
    1.24              /* NB. If we fail to remap the page, we should probably flag it. */
    1.25              make_rx_response(vif, rx.id, 0, RING_STATUS_BAD_PAGE, 0);
    1.26              goto rx_unmap_and_continue;