From d8710943765a982e958e36d54e8aef063ca15274 Mon Sep 17 00:00:00 2001
From: James Chapman <jchapman@katalix.com>
Date: Wed, 4 Jun 2008 15:07:32 -0700
Subject: [PATCH] --- yaml --- r: 97684 b: refs/heads/master c:
 199f7d24ae59894243687a234a909f44a8724506 h: refs/heads/master v: v3

---
 [refs]                       |  2 +-
 trunk/drivers/net/pppol2tp.c | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 7b55ab63cec7..51cc3b92d403 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: b4496d44c6bd8b2da8d370ef49c4b008ce82370b
+refs/heads/master: 199f7d24ae59894243687a234a909f44a8724506
diff --git a/trunk/drivers/net/pppol2tp.c b/trunk/drivers/net/pppol2tp.c
index 8db342f2fdc9..04c7e5b407fd 100644
--- a/trunk/drivers/net/pppol2tp.c
+++ b/trunk/drivers/net/pppol2tp.c
@@ -1279,6 +1279,7 @@ static void pppol2tp_session_destruct(struct sock *sk)
 static int pppol2tp_release(struct socket *sock)
 {
 	struct sock *sk = sock->sk;
+	struct pppol2tp_session *session;
 	int error;
 
 	if (!sk)
@@ -1296,9 +1297,18 @@ static int pppol2tp_release(struct socket *sock)
 	sock_orphan(sk);
 	sock->sk = NULL;
 
+	session = pppol2tp_sock_to_session(sk);
+
 	/* Purge any queued data */
 	skb_queue_purge(&sk->sk_receive_queue);
 	skb_queue_purge(&sk->sk_write_queue);
+	if (session != NULL) {
+		struct sk_buff *skb;
+		while ((skb = skb_dequeue(&session->reorder_q))) {
+			kfree_skb(skb);
+			sock_put(sk);
+		}
+	}
 
 	release_sock(sk);