--- drivers/media/dvb/dvb-core/dvb_net.c

+++ drivers/media/dvb/dvb-core/dvb_net.c

@@ -350,6 +350,7 @@ static void dvb_net_ule( struct net_devi

const u8 *ts, *ts_end, *from_where = NULL;

u8 ts_remain = 0, how_much = 0, new_ts = 1;

struct ethhdr *ethh = NULL;

+ bool error = false;

#ifdef ULE_DEBUG

/* The code inside ULE_DEBUG keeps a history of the last 100 TS cells processed. */

@@ -459,10 +460,16 @@ static void dvb_net_ule( struct net_devi

/* Drop partly decoded SNDU, reset state, resync on PUSI. */

if (priv->ule_skb) {

- dev_kfree_skb( priv->ule_skb );

+ error = true;

+ dev_kfree_skb(priv->ule_skb);

+ }

+

+ if (error || priv->ule_sndu_remain) {

dev->stats.rx_errors++;

dev->stats.rx_frame_errors++;

+ error = false;

}

+

reset_ule(priv);

priv->need_pusi = 1;

continue;

@@ -504,6 +511,7 @@ static void dvb_net_ule( struct net_devi

"bytes left in TS. Resyncing.\n", ts_remain);

priv->ule_sndu_len = 0;

priv->need_pusi = 1;

+ ts += TS_SZ;

continue;

}

@@ -533,6 +541,7 @@ static void dvb_net_ule( struct net_devi

from_where += 2;

}

+ priv->ule_sndu_remain = priv->ule_sndu_len + 2;

/*

* State of current TS:

* ts_remain (remaining bytes in the current TS cell)

@@ -542,6 +551,7 @@ static void dvb_net_ule( struct net_devi

*/

switch (ts_remain) {

case 1:

+ priv->ule_sndu_remain--;

priv->ule_sndu_type = from_where[0] << 8;

priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */

ts_remain -= 1; from_where += 1;

@@ -555,6 +565,7 @@ static void dvb_net_ule( struct net_devi

default: /* complete ULE header is present in current TS. */

/* Extract ULE type field. */

if (priv->ule_sndu_type_1) {

+ priv->ule_sndu_type_1 = 0;

priv->ule_sndu_type |= from_where[0];

from_where += 1; /* points to payload start. */

ts_remain -= 1;