Merge remote-tracking branch 'linus/master' into staging/for_v3.5

* linus/master: (805 commits)
  tty: Fix LED error return
  openvswitch: checking wrong variable in queue_userspace_packet()
  bonding: Fix LACPDU rx_dropped commit.
  Linux 3.4-rc7
  ARM: EXYNOS: fix ctrlbit for exynos5_clk_pdma1
  ARM: EXYNOS: use s5p-timer for UniversalC210 board
  ARM / mach-shmobile: Invalidate caches when booting secondary cores
  ARM / mach-shmobile: sh73a0 SMP TWD boot regression fix
  ARM / mach-shmobile: r8a7779 SMP TWD boot regression fix
  ARM: mach-shmobile: convert ag5evm to use the generic MMC GPIO hotplug helper
  ARM: mach-shmobile: convert mackerel to use the generic MMC GPIO hotplug helper
  MAINTAINERS: Add myself as the cpufreq maintainer
  dm mpath: check if scsi_dh module already loaded before trying to load
  dm thin: correct module description
  dm thin: fix unprotected use of prepared_discards list
  dm thin: reinstate missing mempool_free in cell_release_singleton
  gpio/exynos: Fix compiler warnings when non-exynos machines are selected
  gpio: pch9: Use proper flow type handlers
  powerpc/irq: Fix another case of lazy IRQ state getting out of sync
  ks8851: Update link status during link change interrupt
  ...

Conflicts:
	drivers/media/common/tuners/xc5000.c
	drivers/media/common/tuners/xc5000.h
	drivers/usb/gadget/uvc_queue.c

1 files changed, 2 insertions, 1 deletions

diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 1252c3081ef1..2a11ec2383ee 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -183,7 +183,8 @@ void ovs_flow_used(struct sw_flow *flow, struct sk_buff *skb)
         u8 tcp_flags = 0;
 
         if (flow->key.eth.type == htons(ETH_P_IP) &&
-            flow->key.ip.proto == IPPROTO_TCP) {
+            flow->key.ip.proto == IPPROTO_TCP &&
+            likely(skb->len >= skb_transport_offset(skb) + sizeof(struct tcphdr))) {
                 u8 *tcp = (u8 *)tcp_hdr(skb);
                 tcp_flags = *(tcp + TCP_FLAGS_OFFSET) & TCP_FLAG_MASK;
         }