Should 9ef2e965e554 ["ipv6: drop frames with attached skb->sk in forwarding"] be considered for stable? It did address a crash in ip6_skb_dst_mtu that I was seeing in 3.18, where an incoming packet found an inet_timewait_sock in tcp_v6_early_demux but was later ip6_forward'ed (the local address that had been used for the tcp connection had been moved out of the router).
Thanks, Francesco Ruggeri