From 5655514a6102bb8308659f8be529a802bb2a4ff1 Mon Sep 17 00:00:00 2001
From: "David S. Miller" <davem@davemloft.net>
Date: Thu, 20 Jan 2011 22:52:05 -0800
Subject: [PATCH] --- yaml --- r: 236671 b: refs/heads/master c:
 d52344a7ae8a3fb660636f7de4f1c542b0036cbb h: refs/heads/master i:   236669:
 0ec8625f7bc6e120cdb5df5b04479882b6f4e3b8   236667:
 10b9a45d6a803a3f697696780271e796ecca9f88   236663:
 64870c5218151ae92132514046ba340e67bbaaff   236655:
 962b01ee498bb88af3c7fe94f3eb4f5d9fbf84b6   236639:
 6fcf0444adccc13d1109884acb694100e79b6215   236607:
 42ddb46920544765cf3f220f4164367e0a51169c   236543:
 a1a39cb76461a6521435b3bdf047684a93c29226 v: v3

---
 [refs]                          |  2 +-
 trunk/drivers/net/ppp_generic.c | 31 ++++++++++++++++---------------
 2 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/[refs] b/[refs]
index 22985c9276a4..1bd777c4f496 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 686a2955531312dab77bb6f1e8602787d85e47d8
+refs/heads/master: d52344a7ae8a3fb660636f7de4f1c542b0036cbb
diff --git a/trunk/drivers/net/ppp_generic.c b/trunk/drivers/net/ppp_generic.c
index 1d4fb348488f..9f6d670748d1 100644
--- a/trunk/drivers/net/ppp_generic.c
+++ b/trunk/drivers/net/ppp_generic.c
@@ -1998,7 +1998,7 @@ ppp_mp_reconstruct(struct ppp *ppp)
 	u32 seq = ppp->nextseq;
 	u32 minseq = ppp->minseq;
 	struct sk_buff_head *list = &ppp->mrq;
-	struct sk_buff *p, *next;
+	struct sk_buff *p, *tmp;
 	struct sk_buff *head, *tail;
 	struct sk_buff *skb = NULL;
 	int lost = 0, len = 0;
@@ -2007,14 +2007,15 @@ ppp_mp_reconstruct(struct ppp *ppp)
 		return NULL;
 	head = list->next;
 	tail = NULL;
-	for (p = head; p != (struct sk_buff *) list; p = next) {
-		next = p->next;
+	skb_queue_walk_safe(list, p, tmp) {
+	again:
 		if (seq_before(PPP_MP_CB(p)->sequence, seq)) {
 			/* this can't happen, anyway ignore the skb */
 			netdev_err(ppp->dev, "ppp_mp_reconstruct bad "
 				   "seq %u < %u\n",
 				   PPP_MP_CB(p)->sequence, seq);
-			head = next;
+			__skb_unlink(p, list);
+			kfree_skb(p);
 			continue;
 		}
 		if (PPP_MP_CB(p)->sequence != seq) {
@@ -2026,8 +2027,7 @@ ppp_mp_reconstruct(struct ppp *ppp)
 			lost = 1;
 			seq = seq_before(minseq, PPP_MP_CB(p)->sequence)?
 				minseq + 1: PPP_MP_CB(p)->sequence;
-			next = p;
-			continue;
+			goto again;
 		}
 
 		/*
@@ -2067,9 +2067,17 @@ ppp_mp_reconstruct(struct ppp *ppp)
 		 * and we haven't found a complete valid packet yet,
 		 * we can discard up to and including this fragment.
 		 */
-		if (PPP_MP_CB(p)->BEbits & E)
-			head = next;
+		if (PPP_MP_CB(p)->BEbits & E) {
+			struct sk_buff *tmp2;
 
+			skb_queue_reverse_walk_from_safe(list, p, tmp2) {
+				__skb_unlink(p, list);
+				kfree_skb(p);
+			}
+			head = skb_peek(list);
+			if (!head)
+				break;
+		}
 		++seq;
 	}
 
@@ -2110,13 +2118,6 @@ ppp_mp_reconstruct(struct ppp *ppp)
 		}
 
 		ppp->nextseq = PPP_MP_CB(tail)->sequence + 1;
-		head = tail->next;
-	}
-
-	/* Discard all the skbuffs that we can't use. */
-	while ((p = list->next) != head) {
-		__skb_unlink(p, list);
-		kfree_skb(p);
 	}
 
 	return skb;