--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jan 20 04:37:22 2006
+Date: Fri, 20 Jan 2006 04:31:34 -0800
+From: Andrew Morton <akpm@osdl.org>
+To: stable@kernel.org
+Message-Id: <20060120043134.65a14bfd.akpm@osdl.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Subject: [NET]: Make second arg to skb_reserved() signed.
+
+From: David S. Miller <davem@davemloft.net>
+
+Some subsystems, such as PPP, can send negative values
+here. It just happened to work correctly on 32-bit with
+an unsigned value, but on 64-bit this explodes.
+
+Figured out by Paul Mackerras based upon several PPP crash
+reports.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ include/linux/skbuff.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.15.1.orig/include/linux/skbuff.h
++++ linux-2.6.15.1/include/linux/skbuff.h
+@@ -927,7 +927,7 @@ static inline int skb_tailroom(const str
+ * Increase the headroom of an empty &sk_buff by reducing the tail
+ * room. This is only allowed for an empty buffer.
+ */
+-static inline void skb_reserve(struct sk_buff *skb, unsigned int len)
++static inline void skb_reserve(struct sk_buff *skb, int len)
+ {
+ skb->data += len;
+ skb->tail += len;