--- zzzz-none-000/linux-4.9.218/net/l2tp/l2tp_ip.c	2020-04-02 15:20:41.000000000 +0000
+++ seale-7590ax-750/linux-4.9.218/net/l2tp/l2tp_ip.c	2023-03-29 10:59:08.000000000 +0000
@@ -137,7 +137,7 @@
 	}
 
 	/* Ok, this is a data packet. Lookup the session. */
-	session = l2tp_session_get(net, NULL, session_id, true);
+	session = l2tp_session_get(net, NULL, session_id);
 	if (!session)
 		goto discard;
 
@@ -195,8 +195,6 @@
 	return sk_receive_skb(sk, skb, 1);
 
 discard_sess:
-	if (session->deref)
-		session->deref(session);
 	l2tp_session_dec_refcount(session);
 	goto discard;
 
@@ -232,17 +230,13 @@
 static void l2tp_ip_destroy_sock(struct sock *sk)
 {
 	struct sk_buff *skb;
-	struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+	struct l2tp_tunnel *tunnel = sk->sk_user_data;
 
 	while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL)
 		kfree_skb(skb);
 
-	if (tunnel) {
-		l2tp_tunnel_closeall(tunnel);
-		sock_put(sk);
-	}
-
-	sk_refcnt_debug_dec(sk);
+	if (tunnel)
+		l2tp_tunnel_delete(tunnel);
 }
 
 static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
@@ -433,13 +427,13 @@
 
 	/* Allocate a socket buffer */
 	rc = -ENOMEM;
-	skb = sock_wmalloc(sk, 2 + NET_SKB_PAD + sizeof(struct iphdr) +
-			   4 + len, 0, GFP_KERNEL);
+	skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 4 + len, 0,
+			   GFP_KERNEL);
 	if (!skb)
 		goto error;
 
 	/* Reserve space for headers, putting IP header on 4-byte boundary. */
-	skb_reserve(skb, 2 + NET_SKB_PAD);
+	skb_reserve(skb, NET_SKB_PAD);
 	skb_reset_network_header(skb);
 	skb_reserve(skb, sizeof(struct iphdr));
 	skb_reset_transport_header(skb);