diff --git a/[refs] b/[refs]
index 0a6b0f3e14bf..9668ffe20865 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 535744878e34d01a53f946f26dfbca37186f2cf8
+refs/heads/master: 8f22757ee84da64d4f662f1dd03dae95358a1efe
diff --git a/trunk/drivers/net/tun.c b/trunk/drivers/net/tun.c
index 50b8c6754b1e..a1ed2d983740 100644
--- a/trunk/drivers/net/tun.c
+++ b/trunk/drivers/net/tun.c
@@ -249,8 +249,11 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun, struct iovec *iv,
 
 	if (align)
 		skb_reserve(skb, align);
-	if (memcpy_fromiovec(skb_put(skb, len), iv, len))
+	if (memcpy_fromiovec(skb_put(skb, len), iv, len)) {
+		tun->stats.rx_dropped++;
+		kfree_skb(skb);
 		return -EFAULT;
+	}
 
 	skb->dev = tun->dev;
 	switch (tun->flags & TUN_TYPE_MASK) {