I'm nearly done bisecting, but I'm going to be away for the next ~5 days and won't be able to finish until then.  Here's what's left, in hopes that it's narrow enough to be helpful (bisecting the ubuntu-vivid kernel, output of git bisect visualize):


commit b531f5dd9cb84c5ee40156a230f8e28f69083821
Merge: 2ce7598 45ce829
Author: Linus Torvalds <email address hidden>
Date:   Sun Sep 7 19:56:38 2014 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
    
    Pull networking fixes from David Miller:
    
     1) Fix skb leak in mac802154, from Martin Townsend
    
     2) Use select not depends on NF_NAT for NFT_NAT, from Pablo Neira
        Ayuso
    
     3) Fix union initializer bogosity in vxlan, from Gerhard Stenzel
    
     4) Fix RX checksum configuration in stmmac driver, from Giuseppe
        CAVALLARO
    
     5) Fix TSO with non-accelerated VLANs in e1000, e1000e, bna, ehea,
        i40e, i40evf, mvneta, and qlge, from Vlad Yasevich
    
     6) Fix capability checks in phy_init_eee(), from Giuseppe CAVALLARO
    
     7) Try high order allocations more sanely for SKBs, specifically if a
        high order allocation fails, fall back directly to zero order pages
        rather than iterating down one order at a time.  From Eric Dumazet
    
     8) Fix a memory leak in openvswitch, from Li RongQing
    
     9) amd-xgbe initializes wrong spinlock, from Thomas Lendacky
    
    10) RTNL locking was busted in setsockopt for anycast and multicast, fix
        from Sabrina Dubroca
    
    11) Fix peer address refcount leak in ipv6, from Nicolas Dichtel
    
    12) DocBook typo fixes, from Masanari Iida
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (101 commits)
      ipv6: restore the behavior of ipv6_sock_ac_drop()
      amd-xgbe: Enable interrupts for all management counters
      amd-xgbe: Treat certain counter registers as 64 bit
      greth: moved TX ring cleaning to NAPI rx poll func
      cnic : Cleanup CONFIG_IPV6 & VLAN check
      net: treewide: Fix typo found in DocBook/networking.xml
      bnx2x: Fix link problems for 1G SFP RJ45 module
      3c59x: avoid panic in boomerang_start_xmit when finding page address:
      netfilter: add explicit Kconfig for NETFILTER_XT_NAT
      ipv6: use addrconf_get_prefix_route() to remove peer addr
      ipv6: fix a refcnt leak with peer addr
      net-timestamp: only report sw timestamp if reporting bit is set
      drivers/net/fddi/skfp/h/skfbi.h: Remove useless PCI_BASE_2ND macros
      l2tp: fix race while getting PMTU on PPP pseudo-wire
      ipv6: fix rtnl locking in setsockopt for anycast and multicast
      VMXNET3: Check for map error in vmxnet3_set_mc
      openvswitch: distinguish between the dropped and consumed skb
      amd-xgbe: Fix initialization of the wrong spin lock
      openvswitch: fix a memory leak
      netfilter: fix missing dependencies in NETFILTER_XT_TARGET_LOG
      ...

commit 45ce829dd010668c3839a61b25843590eb4677dc
Merge: de185ab 1bd3fa7
Author: David S. Miller <email address hidden>
Date:   Sun Sep 7 16:11:10 2014 -0700

    Merge tag 'master-2014-09-04' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
    
    John W. Linville says:
    
    ====================
    pull request: wireless 2014-09-05
    
    Please pull this batch of fixes intended for the 3.17 stream...
    
    For the mac80211 bits, Johannes says:
    
    "Here are a few fixes for mac80211. One has been discussed for a while
    and adds a terminating NUL-byte to the alpha2 sent to userspace, which
    shouldn't be necessary but since many places treat it as a string we
    couldn't move to just sending two bytes.
    
    In addition to that, we have two VLAN fixes from Felix, a mesh fix, a
    fix for the recently introduced RX aggregation offload, a revert for
    a broken patch (that luckily didn't really cause any harm) and a small
    fix for alignment in debugfs."
    
    For the iwlwifi bits, Emmanuel says:
    
    "I revert a patch that disabled CTS to self in dvm because users
    reported issues. The revert is CCed to stable since the offending
    patch was sent to stable too. I also bump the firmware API versions
    since a new firmware is coming up. On top of that, Marcel fixes a
    bug I introduced while fixing a bug in our Kconfig file."
    
    Please let me know if there are problems!
    ====================
    
    Signed-off-by: David S. Miller <email address hidden>

commit 1bd3fa7b8c9b2936c16c6e6452f9cc991c405872
Merge: 190355c d88c895
Author: John W. Linville <email address hidden>
Date:   Thu Sep 4 13:12:02 2014 -0400

    Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes

commit 190355cc06eb4b3e2d3f06a8f7ba5ea433d77998
Merge: c665171 14b058b
Author: John W. Linville <email address hidden>
Date:   Thu Sep 4 13:08:24 2014 -0400

    Merge tag 'mac80211-for-john-2014-08-29' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
    
    Johannes Berg <email address hidden> says:
    
    "Here are a few fixes for mac80211. One has been discussed for a while
    and adds a terminating NUL-byte to the alpha2 sent to userspace, which
    shouldn't be necessary but since many places treat it as a string we
    couldn't move to just sending two bytes.
    
    In addition to that, we have two VLAN fixes from Felix, a mesh fix, a
    fix for the recently introduced RX aggregation offload, a revert for
    a broken patch (that luckily didn't really cause any harm) and a small
    fix for alignment in debugfs."
    
    Signed-off-by: John W. Linville <email address hidden>

commit d88c8958dc13b4e4eb7fc57e3f06dc1c4abc7b1f
Author: Emmanuel Grumbach <email address hidden>
Date:   Mon Sep 1 09:50:14 2014 +0300

    iwlwifi: bump firmware API version to 10 for 7000 and 8000
    
    New firmware on the way.
    
    Signed-off-by: Emmanuel Grumbach <email address hidden>

commit 14b058bbce9279ee432f0944ca14df69f4a0d170
Author: Johannes Berg <email address hidden>
Date:   Tue Aug 5 09:34:05 2014 +0200

    mac80211: fix agg_status debugfs file alignment
    
    The "RX active" string is too long, so the columns get
    shifted. Change it to just "RX" to avoid this.
    
    Signed-off-by: Johannes Berg <email address hidden>