ipv4: additional update of dev_net(dev) to struct *net in ip_fragment.c, NULL ptr OOPS

commit bbf31bf18d34caa87dd01f08bf713635593697f2 upstream.

ipv4 ip_frag_reasm(), fully replace 'dev_net(dev)' with 'net', defined
previously patched into 2.6.29.

Between 2.6.28.10 and 2.6.29, net/ipv4/ip_fragment.c was patched,
changing from dev_net(dev) to container_of(...).  Unfortunately the goto
section (out_fail) on oversized packets inside ip_frag_reasm() didn't
get touched up as well.  Oversized IP packets cause a NULL pointer
dereference and immediate hang.

I discovered this running openvasd and my previous email on this is
titled:  NULL pointer dereference at 2.6.32-rc8:net/ipv4/ip_fragment.c:566

Signed-off-by: David Ford <david@blue-labs.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
net: Fix thinko in backport of skb destructor fix.

As noticed by Oliver Hartkopp, the backport of the
'net: Partially allow skb destructors to be used on receive path'
(2.6.30.y commit: 172570a224fe66d560c097e48fca15b620c76e72,
 upstream commit: d55d87fdff8252d0e2f7c28c2d443aee17e9d70f)
was buggy.

It should have added an skb_orphan() call to both skb_set_owner_w()
and skb_set_owner_r().  Instead it added two calls to skb_set_owner_r().

This fixes it up.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Linux 2.6.30.10
Merge tag 'v2.6.30.10' into 2.6.30-maint

This is the 2.6.30.10 stable release

# gpg: Signature made Fri 04 Dec 2009 12:03:08 AM CST using DSA key ID DB2DFB29
# gpg: Can't check signature: No public key

* tag 'v2.6.30.10':
  Linux 2.6.30.10
  net: Fix thinko in backport of skb destructor fix.
  ipv4: additional update of dev_net(dev) to struct *net in ip_fragment.c, NULL ptr OOPS