--- /dev/null
+From 830ae4aac19b308c2fe8f8f8b2e1636dcb1cedd4 Mon Sep 17 00:00:00 2001
+From: stephen hemminger <shemminger@vyatta.com>
+Date: Tue, 15 Jun 2010 06:14:12 +0000
+Subject: bridge: fdb cleanup runs too often
+
+
+From: stephen hemminger <shemminger@vyatta.com>
+
+[ Upstream commit 25442e06d20aaba7d7b16438078a562b3e4cf19b ]
+
+It is common in end-node, non STP bridges to set forwarding
+delay to zero; which causes the forwarding database cleanup
+to run every clock tick. Change to run only as soon as needed
+or at next ageing timer interval which ever is sooner.
+
+Use round_jiffies_up macro rather than attempting round up
+by changing value.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/bridge/br_fdb.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/net/bridge/br_fdb.c
++++ b/net/bridge/br_fdb.c
+@@ -127,7 +127,7 @@ void br_fdb_cleanup(unsigned long _data)
+ {
+ struct net_bridge *br = (struct net_bridge *)_data;
+ unsigned long delay = hold_time(br);
+- unsigned long next_timer = jiffies + br->forward_delay;
++ unsigned long next_timer = jiffies + br->ageing_time;
+ int i;
+
+ spin_lock_bh(&br->hash_lock);
+@@ -148,9 +148,7 @@ void br_fdb_cleanup(unsigned long _data)
+ }
+ spin_unlock_bh(&br->hash_lock);
+
+- /* Add HZ/4 to ensure we round the jiffies upwards to be after the next
+- * timer, otherwise we might round down and will have no-op run. */
+- mod_timer(&br->gc_timer, round_jiffies(next_timer + HZ/4));
++ mod_timer(&br->gc_timer, round_jiffies_up(next_timer));
+ }
+
+ /* Completely flush all dynamic entries in forwarding database.*/
--- /dev/null
+From e2c5a1d655b00d7ff83fd43da5661056ae928803 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Thu, 20 May 2010 23:07:56 -0700
+Subject: gro: Fix bogus gso_size on the first fraglist entry
+
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 622e0ca1cd4d459f5af4f2c65f4dc0dd823cb4c3 ]
+
+When GRO produces fraglist entries, and the resulting skb hits
+an interface that is incapable of TSO but capable of FRAGLIST,
+we end up producing a bogus packet with gso_size non-zero.
+
+This was reported in the field with older versions of KVM that
+did not set the TSO bits on tuntap.
+
+This patch fixes that.
+
+Reported-by: Igor Zhang <yugzhang@redhat.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/core/skbuff.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2729,6 +2729,7 @@ int skb_gro_receive(struct sk_buff **hea
+ *NAPI_GRO_CB(nskb) = *NAPI_GRO_CB(p);
+ skb_shinfo(nskb)->frag_list = p;
+ skb_shinfo(nskb)->gso_size = pinfo->gso_size;
++ pinfo->gso_size = 0;
+ skb_header_release(p);
+ nskb->prev = p;
+
--- /dev/null
+From b9fe2cdcdc079213faac5527de316a293548963a Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Mon, 3 May 2010 23:42:27 -0700
+Subject: ipv6: Fix default multicast hops setting.
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit f935aa9e99d6ec74a50871c120e6b21de7256efb ]
+
+As per RFC 3493 the default multicast hops setting
+for a socket should be "1" just like ipv4.
+
+Ironically we have a IPV6_DEFAULT_MCASTHOPS macro
+it just wasn't being used.
+
+Reported-by: Elliot Hughes <enh@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv6/af_inet6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -199,7 +199,7 @@ lookup_protocol:
+
+ inet_sk(sk)->pinet6 = np = inet6_sk_generic(sk);
+ np->hop_limit = -1;
+- np->mcast_hops = -1;
++ np->mcast_hops = IPV6_DEFAULT_MCASTHOPS;
+ np->mc_loop = 1;
+ np->pmtudisc = IPV6_PMTUDISC_WANT;
+ np->ipv6only = net->ipv6.sysctl.bindv6only;
--- /dev/null
+From adc32c22be012157d1ccfa4a54c774efab890ddd Mon Sep 17 00:00:00 2001
+From: Yoichi Yuasa <yuasa@linux-mips.org>
+Date: Mon, 24 May 2010 18:37:02 -0700
+Subject: net/dccp: expansion of error code size
+
+
+From: Yoichi Yuasa <yuasa@linux-mips.org>
+
+[ Upstream commit d9b52dc6fd1fbb2bad645cbc86a60f984c1cb179 ]
+
+Because MIPS's EDQUOT value is 1133(0x46d).
+It's larger than u8.
+
+Signed-off-by: Yoichi Yuasa <yuasa@linux-mips.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/dccp/input.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/dccp/input.c
++++ b/net/dccp/input.c
+@@ -123,9 +123,9 @@ static int dccp_rcv_closereq(struct sock
+ return queued;
+ }
+
+-static u8 dccp_reset_code_convert(const u8 code)
++static u16 dccp_reset_code_convert(const u8 code)
+ {
+- const u8 error_code[] = {
++ const u16 error_code[] = {
+ [DCCP_RESET_CODE_CLOSED] = 0, /* normal termination */
+ [DCCP_RESET_CODE_UNSPECIFIED] = 0, /* nothing known */
+ [DCCP_RESET_CODE_ABORTED] = ECONNRESET,
+@@ -147,7 +147,7 @@ static u8 dccp_reset_code_convert(const
+
+ static void dccp_rcv_reset(struct sock *sk, struct sk_buff *skb)
+ {
+- u8 err = dccp_reset_code_convert(dccp_hdr_reset(skb)->dccph_reset_code);
++ u16 err = dccp_reset_code_convert(dccp_hdr_reset(skb)->dccph_reset_code);
+
+ sk->sk_err = err;
+
--- /dev/null
+From 7530475f9b50c2d02b272913fceb43f3c7924a9c Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Mon, 10 May 2010 04:59:07 -0700
+Subject: net: Fix FDDI and TR config checks in ipv4 arp and LLC.
+
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit f0ecde1466f21edf577b809735f4f35f354777a0 ]
+
+Need to check both CONFIG_FOO and CONFIG_FOO_MODULE
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/arp.c | 6 +++---
+ net/llc/llc_sap.c | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -619,13 +619,13 @@ struct sk_buff *arp_create(int type, int
+ #endif
+ #endif
+
+-#ifdef CONFIG_FDDI
++#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
+ case ARPHRD_FDDI:
+ arp->ar_hrd = htons(ARPHRD_ETHER);
+ arp->ar_pro = htons(ETH_P_IP);
+ break;
+ #endif
+-#ifdef CONFIG_TR
++#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
+ case ARPHRD_IEEE802_TR:
+ arp->ar_hrd = htons(ARPHRD_IEEE802);
+ arp->ar_pro = htons(ETH_P_IP);
+@@ -1005,7 +1005,7 @@ static int arp_req_set(struct net *net,
+ return -EINVAL;
+ }
+ switch (dev->type) {
+-#ifdef CONFIG_FDDI
++#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
+ case ARPHRD_FDDI:
+ /*
+ * According to RFC 1390, FDDI devices should accept ARP
+--- a/net/llc/llc_sap.c
++++ b/net/llc/llc_sap.c
+@@ -30,7 +30,7 @@ static int llc_mac_header_len(unsigned s
+ case ARPHRD_ETHER:
+ case ARPHRD_LOOPBACK:
+ return sizeof(struct ethhdr);
+-#ifdef CONFIG_TR
++#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
+ case ARPHRD_IEEE802_TR:
+ return sizeof(struct trh_hdr);
+ #endif
--- /dev/null
+From 0feef5564eb60e669eabfd32bec84615ee9a76d5 Mon Sep 17 00:00:00 2001
+From: Tadashi Abe <tabe@mvista.com>
+Date: Mon, 17 May 2010 22:41:45 -0700
+Subject: pegasus: fix USB device ID for ETX-US2
+
+
+From: Tadashi Abe <tabe@mvista.com>
+
+[ Upstream commit 95718c1c25370b2c85061a4d8dfab2831b3ad280 ]
+
+USB device ID definition for I-O Data ETX-US2 is wrong.
+Correct ID is 0x093a. Here's snippet from /proc/bus/usb/devices;
+
+T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ff(vend.) Sub=ff Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=04bb ProdID=093a Rev= 1.01
+S: Manufacturer=I-O DATA DEVICE,INC.
+S: Product=I-O DATA ETX2-US2
+S: SerialNumber=A26427
+C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=224mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=00 Driver=pegasus
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=03(Int.) MxPS= 8 Ivl=125us
+
+This patch enables pegasus driver to work fine with ETX-US2.
+
+Signed-off-by: Tadashi Abe <tabe@mvista.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/usb/pegasus.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/usb/pegasus.h
++++ b/drivers/net/usb/pegasus.h
+@@ -254,7 +254,7 @@ PEGASUS_DEV( "IO DATA USB ET/TX", VENDOR
+ DEFAULT_GPIO_RESET )
+ PEGASUS_DEV( "IO DATA USB ET/TX-S", VENDOR_IODATA, 0x0913,
+ DEFAULT_GPIO_RESET | PEGASUS_II )
+-PEGASUS_DEV( "IO DATA USB ETX-US2", VENDOR_IODATA, 0x092a,
++PEGASUS_DEV( "IO DATA USB ETX-US2", VENDOR_IODATA, 0x093a,
+ DEFAULT_GPIO_RESET | PEGASUS_II )
+ PEGASUS_DEV( "Kingston KNU101TX Ethernet", VENDOR_KINGSTON, 0x000a,
+ DEFAULT_GPIO_RESET)
--- /dev/null
+From 58d08fe5684a974d705142e555a1f433bf0a9d63 Mon Sep 17 00:00:00 2001
+From: Timo Teräs <timo.teras@iki.fi>
+Date: Mon, 5 Jul 2010 22:05:02 -0700
+Subject: r8169: fix mdio_read and update mdio_write according to hw specs
+
+
+From: Timo Teräs <timo.teras@iki.fi>
+
+[ Upstream commit 81a95f049962ec20a9aed888e676208b206f0f2e ]
+
+Realtek confirmed that a 20us delay is needed after mdio_read and
+mdio_write operations. Reduce the delay in mdio_write, and add it
+to mdio_read too. Also add a comment that the 20us is from hw specs.
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+Acked-by: Francois Romieu <romieu@fr.zoreil.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/r8169.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -558,10 +558,10 @@ static void mdio_write(void __iomem *ioa
+ udelay(25);
+ }
+ /*
+- * Some configurations require a small delay even after the write
+- * completed indication or the next write might fail.
++ * According to hardware specs a 20us delay is required after write
++ * complete indication, but before sending next command.
+ */
+- udelay(25);
++ udelay(20);
+ }
+
+ static int mdio_read(void __iomem *ioaddr, int reg_addr)
+@@ -581,6 +581,12 @@ static int mdio_read(void __iomem *ioadd
+ }
+ udelay(25);
+ }
++ /*
++ * According to hardware specs a 20us delay is required after read
++ * complete indication, but before sending next command.
++ */
++ udelay(20);
++
+ return value;
+ }
+
--- /dev/null
+From 54d56dfeacb35afdffb54724ef39bef28a689b5e Mon Sep 17 00:00:00 2001
+From: Timo Teräs <timo.teras@iki.fi>
+Date: Mon, 5 Jul 2010 22:04:45 -0700
+Subject: r8169: fix random mdio_write failures
+
+
+From: Timo Teräs <timo.teras@iki.fi>
+
+[ Upstream commit 024a07bacf8287a6ddfa83e9d5b951c5e8b4070e ]
+
+Some configurations need delay between the "write completed" indication
+and new write to work reliably.
+
+Realtek driver seems to use longer delay when polling the "write complete"
+bit, so it waits long enough between writes with high probability (but
+could probably break too). This patch adds a new udelay to make sure we
+wait unconditionally some time after the write complete indication.
+
+This caused a regression with XID 18000000 boards when the board specific
+phy configuration writing many mdio registers was added in commit
+2e955856ff (r8169: phy init for the 8169scd). Some of the configration
+mdio writes would almost always fail, and depending on failure might leave
+the PHY in non-working state.
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+Acked-off-by: Francois Romieu <romieu@fr.zoreil.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/r8169.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -557,6 +557,11 @@ static void mdio_write(void __iomem *ioa
+ break;
+ udelay(25);
+ }
++ /*
++ * Some configurations require a small delay even after the write
++ * completed indication or the next write might fail.
++ */
++ udelay(25);
+ }
+
+ static int mdio_read(void __iomem *ioaddr, int reg_addr)
--- /dev/null
+bridge-fdb-cleanup-runs-too-often.patch
+net-dccp-expansion-of-error-code-size.patch
+gro-fix-bogus-gso_size-on-the-first-fraglist-entry.patch
+ipv6-fix-default-multicast-hops-setting.patch
+net-fix-fddi-and-tr-config-checks-in-ipv4-arp-and-llc.patch
+pegasus-fix-usb-device-id-for-etx-us2.patch
+r8169-fix-random-mdio_write-failures.patch
+r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch
+tcp-tcp_synack_options-fix.patch
+tcp-use-correct-net-ns-in-cookie_v4_check.patch
+veth-dont-kfree_skb-after-dev_forward_skb.patch
--- /dev/null
+From aad91c50da64ccc3663aa5a729add5850f6331a4 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Mon, 17 May 2010 22:35:36 -0700
+Subject: tcp: tcp_synack_options() fix
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit de213e5eedecdfb1b1eea7e6be28bc64cac5c078 ]
+
+Commit 33ad798c924b4a (tcp: options clean up) introduced a problem
+if MD5+SACK+timestamps were used in initial SYN message.
+
+Some stacks (old linux for example) try to negotiate MD5+SACK+TSTAMP
+sessions, but since 40 bytes of tcp options space are not enough to
+store all the bits needed, we chose to disable timestamps in this case.
+
+We send a SYN-ACK _without_ timestamp option, but socket has timestamps
+enabled and all further outgoing messages contain a TS block, all with
+the initial timestamp of the remote peer.
+
+Fix is to really disable timestamps option for the whole session.
+
+Reported-by: Bijay Singh <Bijay.Singh@guavus.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp_output.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -659,7 +659,6 @@ static unsigned tcp_synack_options(struc
+ u8 cookie_plus = (xvp != NULL && !xvp->cookie_out_never) ?
+ xvp->cookie_plus :
+ 0;
+- bool doing_ts = ireq->tstamp_ok;
+
+ #ifdef CONFIG_TCP_MD5SIG
+ *md5 = tcp_rsk(req)->af_specific->md5_lookup(sk, req);
+@@ -672,7 +671,7 @@ static unsigned tcp_synack_options(struc
+ * rather than TS in order to fit in better with old,
+ * buggy kernels, but that was deemed to be unnecessary.
+ */
+- doing_ts &= !ireq->sack_ok;
++ ireq->tstamp_ok &= !ireq->sack_ok;
+ }
+ #else
+ *md5 = NULL;
+@@ -687,7 +686,7 @@ static unsigned tcp_synack_options(struc
+ opts->options |= OPTION_WSCALE;
+ remaining -= TCPOLEN_WSCALE_ALIGNED;
+ }
+- if (likely(doing_ts)) {
++ if (likely(ireq->tstamp_ok)) {
+ opts->options |= OPTION_TS;
+ opts->tsval = TCP_SKB_CB(skb)->when;
+ opts->tsecr = req->ts_recent;
+@@ -695,7 +694,7 @@ static unsigned tcp_synack_options(struc
+ }
+ if (likely(ireq->sack_ok)) {
+ opts->options |= OPTION_SACK_ADVERTISE;
+- if (unlikely(!doing_ts))
++ if (unlikely(!ireq->tstamp_ok))
+ remaining -= TCPOLEN_SACKPERM_ALIGNED;
+ }
+
+@@ -703,7 +702,7 @@ static unsigned tcp_synack_options(struc
+ * If the <SYN> options fit, the same options should fit now!
+ */
+ if (*md5 == NULL &&
+- doing_ts &&
++ ireq->tstamp_ok &&
+ cookie_plus > TCPOLEN_COOKIE_BASE) {
+ int need = cookie_plus; /* has TCPOLEN_COOKIE_BASE */
+
--- /dev/null
+From c0d10c8e809ba320da97f8767b0c59430307fbf9 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Thu, 3 Jun 2010 05:45:47 +0000
+Subject: tcp: use correct net ns in cookie_v4_check()
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit c44649216522cd607a4027d2ebf4a8147d3fa94c ]
+
+Its better to make a route lookup in appropriate namespace.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/syncookies.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/syncookies.c
++++ b/net/ipv4/syncookies.c
+@@ -347,7 +347,7 @@ struct sock *cookie_v4_check(struct sock
+ { .sport = th->dest,
+ .dport = th->source } } };
+ security_req_classify_flow(req, &fl);
+- if (ip_route_output_key(&init_net, &rt, &fl)) {
++ if (ip_route_output_key(sock_net(sk), &rt, &fl)) {
+ reqsk_free(req);
+ goto out;
+ }
--- /dev/null
+From ffc6c72d51b934da6bae5a226aebc0b50d57fac0 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Mon, 5 Jul 2010 22:12:53 -0700
+Subject: veth: Dont kfree_skb() after dev_forward_skb()
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 6ec82562ffc6f297d0de36d65776cff8e5704867 ]
+
+In case of congestion, netif_rx() frees the skb, so we must assume
+dev_forward_skb() also consume skb.
+
+Bug introduced by commit 445409602c092
+(veth: move loopback logic to common location)
+
+We must change dev_forward_skb() to always consume skb, and veth to not
+double free it.
+
+Bug report : http://marc.info/?l=linux-netdev&m=127310770900442&w=3
+
+Reported-by: Martín Ferrari <martin.ferrari@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/veth.c | 1 -
+ net/core/dev.c | 10 +++++-----
+ 2 files changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -186,7 +186,6 @@ tx_drop:
+ return NETDEV_TX_OK;
+
+ rx_drop:
+- kfree_skb(skb);
+ rcv_stats->rx_dropped++;
+ return NETDEV_TX_OK;
+ }
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1428,7 +1428,7 @@ static inline void net_timestamp(struct
+ *
+ * return values:
+ * NET_RX_SUCCESS (no congestion)
+- * NET_RX_DROP (packet was dropped)
++ * NET_RX_DROP (packet was dropped, but freed)
+ *
+ * dev_forward_skb can be used for injecting an skb from the
+ * start_xmit function of one device into the receive queue
+@@ -1442,11 +1442,11 @@ int dev_forward_skb(struct net_device *d
+ {
+ skb_orphan(skb);
+
+- if (!(dev->flags & IFF_UP))
+- return NET_RX_DROP;
+-
+- if (skb->len > (dev->mtu + dev->hard_header_len))
++ if (!(dev->flags & IFF_UP) ||
++ (skb->len > (dev->mtu + dev->hard_header_len))) {
++ kfree_skb(skb);
+ return NET_RX_DROP;
++ }
+
+ skb_dst_drop(skb);
+ skb->tstamp.tv64 = 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
