From 90efb7b9543f8e2291f75626b856760512330e51 Mon Sep 17 00:00:00 2001
From: Ben McKeegan <ben@netservers.co.uk>
Date: Mon, 16 Nov 2009 03:44:25 +0000
Subject: [PATCH] --- yaml --- r: 168760 b: refs/heads/master c:
 82b3cc1a2f5e46300a9dec4a8cc8106dc20a4c23 h: refs/heads/master v: v3

---
 [refs]                          |  2 +-
 trunk/drivers/net/ppp_generic.c | 11 +++++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/[refs] b/[refs]
index 7d8a83ac739e..f9e4ad03d493 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: c0e1f68bce454d244e2eea6b0ab7b3a217c673d2
+refs/heads/master: 82b3cc1a2f5e46300a9dec4a8cc8106dc20a4c23
diff --git a/trunk/drivers/net/ppp_generic.c b/trunk/drivers/net/ppp_generic.c
index 9bf2a6be9031..965adb6174c3 100644
--- a/trunk/drivers/net/ppp_generic.c
+++ b/trunk/drivers/net/ppp_generic.c
@@ -1944,8 +1944,15 @@ ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 	}
 
 	/* Pull completed packets off the queue and receive them. */
-	while ((skb = ppp_mp_reconstruct(ppp)))
-		ppp_receive_nonmp_frame(ppp, skb);
+	while ((skb = ppp_mp_reconstruct(ppp))) {
+		if (pskb_may_pull(skb, 2))
+			ppp_receive_nonmp_frame(ppp, skb);
+		else {
+			++ppp->dev->stats.rx_length_errors;
+			kfree_skb(skb);
+			ppp_receive_error(ppp);
+		}
+	}
 
 	return;