--- /dev/null
+Fix crash with actions performed on the underlying interface (MAC address,
+MTU or link state update). This triggers pppoe_flush_dev(), which cleans up
+the device without announcing it in sk->sk_state.
+
+Patch by Guillaume Nault (pulled from netdev@vger)
+
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -313,7 +313,6 @@ static void pppoe_flush_dev(struct net_d
+ if (po->pppoe_dev == dev &&
+ sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
+ pppox_unbind_sock(sk);
+- sk->sk_state = PPPOX_ZOMBIE;
+ sk->sk_state_change(sk);
+ po->pppoe_dev = NULL;
+ dev_put(dev);
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
-@@ -869,7 +869,7 @@ static int pppoe_sendmsg(struct kiocb *i
+@@ -868,7 +868,7 @@ static int pppoe_sendmsg(struct kiocb *i
goto end;
0, GFP_KERNEL);
if (!skb) {
error = -ENOMEM;
-@@ -877,7 +877,7 @@ static int pppoe_sendmsg(struct kiocb *i
+@@ -876,7 +876,7 @@ static int pppoe_sendmsg(struct kiocb *i
}
/* Reserve space for headers. */