commit 0d0675cf44c85bd3c0d891845aa02f9249cd7c68
Author: Greg Kroah-Hartman <gregkh@suse.de>
Date:   Thu Dec 3 22:00:07 2009 -0800

    Linux 2.6.30.10

commit 768db3901820f355efb158c6913ecdb19bbfd9ed
Author: David Miller <davem@davemloft.net>
Date:   Wed Dec 2 16:01:04 2009 -0800

    net: Fix thinko in backport of skb destructor fix.
    
    As noticed by Oliver Hartkopp, the backport of the
    'net: Partially allow skb destructors to be used on receive path'
    (2.6.30.y commit: 172570a224fe66d560c097e48fca15b620c76e72,
     upstream commit: d55d87fdff8252d0e2f7c28c2d443aee17e9d70f)
    was buggy.
    
    It should have added an skb_orphan() call to both skb_set_owner_w()
    and skb_set_owner_r().  Instead it added two calls to skb_set_owner_r().
    
    This fixes it up.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit b260d762f963bf8d518c28b3524dca40af5d416e
Author: David Ford <david@blue-labs.org>
Date:   Sun Nov 29 23:02:22 2009 -0800

    ipv4: additional update of dev_net(dev) to struct *net in ip_fragment.c, NULL ptr OOPS
    
    commit bbf31bf18d34caa87dd01f08bf713635593697f2 upstream.
    
    ipv4 ip_frag_reasm(), fully replace 'dev_net(dev)' with 'net', defined
    previously patched into 2.6.29.
    
    Between 2.6.28.10 and 2.6.29, net/ipv4/ip_fragment.c was patched,
    changing from dev_net(dev) to container_of(...).  Unfortunately the goto
    section (out_fail) on oversized packets inside ip_frag_reasm() didn't
    get touched up as well.  Oversized IP packets cause a NULL pointer
    dereference and immediate hang.
    
    I discovered this running openvasd and my previous email on this is
    titled:  NULL pointer dereference at 2.6.32-rc8:net/ipv4/ip_fragment.c:566
    
    Signed-off-by: David Ford <david@blue-labs.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>