From: James Chapman <jchap...@katalix.com>
Date: Mon, 12 Feb 2018 10:11:06 +0000
> If an L2TPIP socket is closed, add RCU protection when we deref
> sk_user_data to prevent races with another thread closing the same
> tunnel.
>
> Fixes: 0d76751fad ("l2tp: Add L2TPv3 IP encapsulation (no UDP) support")
Another patch with no signoff, and:
> refcount_t: increment on 0; use-after-free.
> WARNING: CPU: 2 PID: 2892 at lib/refcount.c:153 refcount_inc+0x2b/0x30
> Modules linked in:
> CPU: 2 PID: 2892 Comm: pppol2tp_chaos Not tainted 4.15.0-rc9+ #1
...
a kernel log dump which should be in the commit message body.
