diff --git a/[refs] b/[refs]
index 1b369aee79a8..c5690bd8ca37 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: c8fff1cf4e4e5e420c929469a09427aa37342928
+refs/heads/master: ec9b6add7d81f902f6094e71f595da4a362f3348
diff --git a/trunk/drivers/net/pppol2tp.c b/trunk/drivers/net/pppol2tp.c
index dcd499118b95..86e5dba079fe 100644
--- a/trunk/drivers/net/pppol2tp.c
+++ b/trunk/drivers/net/pppol2tp.c
@@ -1111,6 +1111,8 @@ static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)
 	for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {
 again:
 		hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
+			struct sk_buff *skb;
+
 			session = hlist_entry(walk, struct pppol2tp_session, hlist);
 
 			sk = session->sock;
@@ -1139,7 +1141,10 @@ static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)
 			/* Purge any queued data */
 			skb_queue_purge(&sk->sk_receive_queue);
 			skb_queue_purge(&sk->sk_write_queue);
-			skb_queue_purge(&session->reorder_q);
+			while ((skb = skb_dequeue(&session->reorder_q))) {
+				kfree_skb(skb);
+				sock_put(sk);
+			}
 
 			release_sock(sk);
 			sock_put(sk);