--- zzzz-none-000/linux-5.4.213/net/l2tp/l2tp_core.c	2022-09-15 10:04:56.000000000 +0000
+++ miami-7690-761/linux-5.4.213/net/l2tp/l2tp_core.c	2024-05-29 11:20:02.000000000 +0000
@@ -355,6 +355,30 @@
 }
 EXPORT_SYMBOL_GPL(l2tp_session_register);
 
+void l2tp_stats_update(struct l2tp_tunnel *tunnel,
+		       struct l2tp_session *session,
+		       struct l2tp_stats *stats)
+{
+	atomic_long_add(atomic_long_read(&stats->rx_packets),
+			&tunnel->stats.rx_packets);
+	atomic_long_add(atomic_long_read(&stats->rx_bytes),
+			&tunnel->stats.rx_bytes);
+	atomic_long_add(atomic_long_read(&stats->tx_packets),
+			&tunnel->stats.tx_packets);
+	atomic_long_add(atomic_long_read(&stats->tx_bytes),
+			&tunnel->stats.tx_bytes);
+
+	atomic_long_add(atomic_long_read(&stats->rx_packets),
+			&session->stats.rx_packets);
+	atomic_long_add(atomic_long_read(&stats->rx_bytes),
+			&session->stats.rx_bytes);
+	atomic_long_add(atomic_long_read(&stats->tx_packets),
+			&session->stats.tx_packets);
+	atomic_long_add(atomic_long_read(&stats->tx_bytes),
+			&session->stats.tx_bytes);
+}
+EXPORT_SYMBOL_GPL(l2tp_stats_update);
+
 /*****************************************************************************
  * Receive data handling
  *****************************************************************************/
@@ -724,8 +748,10 @@
 		}
 	}
 
-	/* Session data offset is defined only for L2TPv2 and is
-	 * indicated by an optional 16-bit value in the header.
+	/* Session data offset is handled differently for L2TPv2 and
+	 * L2TPv3. For L2TPv2, there is an optional 16-bit value in
+	 * the header. For L2TPv3, the offset is negotiated using AVPs
+	 * in the session setup control protocol.
 	 */
 	if (tunnel->version == L2TP_HDR_VER_2) {
 		/* If offset bit set, skip it. */
@@ -733,7 +759,8 @@
 			offset = ntohs(*(__be16 *)ptr);
 			ptr += 2 + offset;
 		}
-	}
+	} else
+		ptr += session->offset;
 
 	offset = ptr - optr;
 	if (!pskb_may_pull(skb, offset))
@@ -1002,6 +1029,8 @@
 		*((__be32 *)bufp) = htonl(l2h);
 		bufp += 4;
 	}
+	if (session->offset)
+		bufp += session->offset;
 
 	return bufp - optr;
 }
@@ -1086,7 +1115,7 @@
 	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
 	IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
 			      IPSKB_REROUTED);
-	nf_reset_ct(skb);
+	nf_reset_no_generic_ct(skb);
 
 	bh_lock_sock(sk);
 	if (sock_owned_by_user(sk)) {
@@ -1635,7 +1664,7 @@
 		if (session->send_seq)
 			session->hdr_len += 4;
 	} else {
-		session->hdr_len = 4 + session->cookie_len;
+		session->hdr_len = 4 + session->cookie_len + session->offset;
 		session->hdr_len += l2tp_get_l2specific_len(session);
 		if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
 			session->hdr_len += 4;
@@ -1684,6 +1713,7 @@
 			session->recv_seq = cfg->recv_seq;
 			session->lns_mode = cfg->lns_mode;
 			session->reorder_timeout = cfg->reorder_timeout;
+			session->offset = cfg->offset;
 			session->l2specific_type = cfg->l2specific_type;
 			session->cookie_len = cfg->cookie_len;
 			memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);