--- /dev/null
+From wei.liu2@citrix.com Mon Dec 2 09:57:28 2013
+From: Wei Liu <wei.liu2@citrix.com>
+Date: Mon, 2 Dec 2013 17:49:54 +0000
+Subject: xen-netback: fix refcnt unbalance for 3.10
+To: Greg KH <gregkh@linuxfoundation.org>
+Cc: Wei Liu <wei.liu2@citrix.com>, <xen-devel@lists.xen.org>, <netdev@vger.kernel.org>, <stable@vger.kernel.org>, <tomasz.wroblewski@citrix.com>, Ian Campbell <ian.campbell@citrix.com>, Konrad Wilk <konrad.wilk@oracle.com>, David Vrabel <david.vrabel@citrix.com>
+Message-ID: <20131202174954.GD14293@zion.uk.xensource.com>
+Content-Disposition: inline
+
+From: Wei Liu <wei.liu2@citrix.com>
+
+With the introduction of "xen-netback: Don't destroy the netdev until
+the vif is shut down" (upstream commit id 279f438e36), vif disconnect
+and free are separated. However in the backported version reference
+counting code was not correctly modified, and the reset of vif->irq
+was lost. If frontend goes through vif life cycle more than once the
+reference counting is skewed.
+
+This patch adds back the missing vif->irq reset line. It also moves
+several lines of the reference counting code to vif_free, so the moved
+code corresponds to the counterpart in vif_alloc, thus the reference
+counting is balanced.
+
+Signed-off-by: Wei Liu <wei.liu2@citrix.com>
+Acked-by: Ian Campbell <ian.campbell@citrix.com>
+Cc: Konrad Wilk <konrad.wilk@oracle.com>
+Cc: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/xen-netback/interface.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -365,17 +365,19 @@ void xenvif_disconnect(struct xenvif *vi
+ if (netif_carrier_ok(vif->dev))
+ xenvif_carrier_off(vif);
+
+- atomic_dec(&vif->refcnt);
+- wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0);
+-
+- if (vif->irq)
++ if (vif->irq) {
+ unbind_from_irqhandler(vif->irq, vif);
++ vif->irq = 0;
++ }
+
+ xen_netbk_unmap_frontend_rings(vif);
+ }
+
+ void xenvif_free(struct xenvif *vif)
+ {
++ atomic_dec(&vif->refcnt);
++ wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0);
++
+ unregister_netdev(vif->dev);
+
+ free_netdev(vif->dev);