From: Guillaume Nault <g.na...@alphalink.fr>
Date: Wed, 29 Mar 2017 08:45:29 +0200
> The Rx path may grab the socket right before pppol2tp_release(), but
> nothing guarantees that it will enqueue packets before
> skb_queue_purge(). Therefore, the socket can be destroyed without its
> queues fully purged.
>
> Fix this by purging queues in pppol2tp_session_destruct() where we're
> guaranteed nothing is still referencing the socket.
>
> Fixes: 9e9cb6221aa7 ("l2tp: fix userspace reception on plain L2TP sockets")
> Signed-off-by: Guillaume Nault <g.na...@alphalink.fr>
Applied.
