7 files changed, 184 insertions, 88 deletions

diff --git a/net/l2tp/Kconfig b/net/l2tp/Kconfig
index 147a8fd47a17..adb9843dd7cf 100644
--- a/net/l2tp/Kconfig
+++ b/net/l2tp/Kconfig
@@ -46,8 +46,8 @@ config L2TP_DEBUGFS
           will be called l2tp_debugfs.
 
 config L2TP_V3
-        bool "L2TPv3 support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && L2TP
+        bool "L2TPv3 support"
+        depends on L2TP
         help
           Layer Two Tunneling Protocol Version 3
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 1a9f3723c13c..dcfd64e83ab7 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -101,6 +101,7 @@ struct l2tp_skb_cb {
 
 static atomic_t l2tp_tunnel_count;
 static atomic_t l2tp_session_count;
+static struct workqueue_struct *l2tp_wq;
 
 /* per-net private data for this module */
 static unsigned int l2tp_net_id;
@@ -122,7 +123,6 @@ static inline struct l2tp_net *l2tp_pernet(struct net *net)
         return net_generic(net, l2tp_net_id);
 }
 
-
 /* Tunnel reference counts. Incremented per session that is added to
  * the tunnel.
  */
@@ -168,6 +168,51 @@ l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
 
 }
 
+/* Lookup the tunnel socket, possibly involving the fs code if the socket is
+ * owned by userspace.  A struct sock returned from this function must be
+ * released using l2tp_tunnel_sock_put once you're done with it.
+ */
+struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
+{
+        int err = 0;
+        struct socket *sock = NULL;
+        struct sock *sk = NULL;
+
+        if (!tunnel)
+                goto out;
+
+        if (tunnel->fd >= 0) {
+                /* Socket is owned by userspace, who might be in the process
+                 * of closing it.  Look the socket up using the fd to ensure
+                 * consistency.
+                 */
+                sock = sockfd_lookup(tunnel->fd, &err);
+                if (sock)
+                        sk = sock->sk;
+        } else {
+                /* Socket is owned by kernelspace */
+                sk = tunnel->sock;
+        }
+
+out:
+        return sk;
+}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_lookup);
+
+/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
+void l2tp_tunnel_sock_put(struct sock *sk)
+{
+        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+        if (tunnel) {
+                if (tunnel->fd >= 0) {
+                        /* Socket is owned by userspace */
+                        sockfd_put(sk->sk_socket);
+                }
+                sock_put(sk);
+        }
+}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_put);
+
 /* Lookup a session by id in the global session list
  */
 static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
@@ -1123,8 +1168,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
         struct udphdr *uh;
         struct inet_sock *inet;
         __wsum csum;
-        int old_headroom;
-        int new_headroom;
         int headroom;
         int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
         int udp_len;
@@ -1136,16 +1179,12 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
          */
         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
                 uhlen + hdr_len;
-        old_headroom = skb_headroom(skb);
         if (skb_cow_head(skb, headroom)) {
                 kfree_skb(skb);
                 return NET_XMIT_DROP;
         }
 
-        new_headroom = skb_headroom(skb);
         skb_orphan(skb);
-        skb->truesize += new_headroom - old_headroom;
-
         /* Setup L2TP header */
         session->build_header(session, __skb_push(skb, hdr_len));
 
@@ -1232,6 +1271,7 @@ EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
 static void l2tp_tunnel_destruct(struct sock *sk)
 {
         struct l2tp_tunnel *tunnel;
+        struct l2tp_net *pn;
 
         tunnel = sk->sk_user_data;
         if (tunnel == NULL)
@@ -1239,9 +1279,8 @@ static void l2tp_tunnel_destruct(struct sock *sk)
 
         l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
 
-        /* Close all sessions */
-        l2tp_tunnel_closeall(tunnel);
 
+        /* Disable udp encapsulation */
         switch (tunnel->encap) {
         case L2TP_ENCAPTYPE_UDP:
                 /* No longer an encapsulation socket. See net/ipv4/udp.c */
@@ -1253,17 +1292,23 @@ static void l2tp_tunnel_destruct(struct sock *sk)
         }
 
         /* Remove hooks into tunnel socket */
-        tunnel->sock = NULL;
         sk->sk_destruct = tunnel->old_sk_destruct;
         sk->sk_user_data = NULL;
+        tunnel->sock = NULL;
 
-        /* Call the original destructor */
-        if (sk->sk_destruct)
-                (*sk->sk_destruct)(sk);
+        /* Remove the tunnel struct from the tunnel list */
+        pn = l2tp_pernet(tunnel->l2tp_net);
+        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
+        list_del_rcu(&tunnel->list);
+        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+        atomic_dec(&l2tp_tunnel_count);
 
-        /* We're finished with the socket */
+        l2tp_tunnel_closeall(tunnel);
         l2tp_tunnel_dec_refcount(tunnel);
 
+        /* Call the original destructor */
+        if (sk->sk_destruct)
+                (*sk->sk_destruct)(sk);
 end:
         return;
 }
@@ -1337,48 +1382,77 @@ again:
  */
 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
 {
-        struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
-
         BUG_ON(atomic_read(&tunnel->ref_count) != 0);
         BUG_ON(tunnel->sock != NULL);
-
         l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: free...\n", tunnel->name);
-
-        /* Remove from tunnel list */
-        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
-        list_del_rcu(&tunnel->list);
         kfree_rcu(tunnel, rcu);
-        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+}
 
-        atomic_dec(&l2tp_tunnel_count);
+/* Workqueue tunnel deletion function */
+static void l2tp_tunnel_del_work(struct work_struct *work)
+{
+        struct l2tp_tunnel *tunnel = NULL;
+        struct socket *sock = NULL;
+        struct sock *sk = NULL;
+
+        tunnel = container_of(work, struct l2tp_tunnel, del_work);
+        sk = l2tp_tunnel_sock_lookup(tunnel);
+        if (!sk)
+                return;
+
+        sock = sk->sk_socket;
+        BUG_ON(!sock);
+
+        /* If the tunnel socket was created directly by the kernel, use the
+         * sk_* API to release the socket now.  Otherwise go through the
+         * inet_* layer to shut the socket down, and let userspace close it.
+         * In either case the tunnel resources are freed in the socket
+         * destructor when the tunnel socket goes away.
+         */
+        if (sock->file == NULL) {
+                kernel_sock_shutdown(sock, SHUT_RDWR);
+                sk_release_kernel(sk);
+        } else {
+                inet_shutdown(sock, 2);
+        }
+
+        l2tp_tunnel_sock_put(sk);
 }
 
 /* Create a socket for the tunnel, if one isn't set up by
  * userspace. This is used for static tunnels where there is no
  * managing L2TP daemon.
+ *
+ * Since we don't want these sockets to keep a namespace alive by
+ * themselves, we drop the socket's namespace refcount after creation.
+ * These sockets are freed when the namespace exits using the pernet
+ * exit hook.
  */
-static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct socket **sockp)
+static int l2tp_tunnel_sock_create(struct net *net,
+                                u32 tunnel_id,
+                                u32 peer_tunnel_id,
+                                struct l2tp_tunnel_cfg *cfg,
+                                struct socket **sockp)
 {
         int err = -EINVAL;
-        struct sockaddr_in udp_addr;
+        struct socket *sock = NULL;
+        struct sockaddr_in udp_addr = {0};
+        struct sockaddr_l2tpip ip_addr = {0};
 #if IS_ENABLED(CONFIG_IPV6)
-        struct sockaddr_in6 udp6_addr;
-        struct sockaddr_l2tpip6 ip6_addr;
+        struct sockaddr_in6 udp6_addr = {0};
+        struct sockaddr_l2tpip6 ip6_addr = {0};
 #endif
-        struct sockaddr_l2tpip ip_addr;
-        struct socket *sock = NULL;
 
         switch (cfg->encap) {
         case L2TP_ENCAPTYPE_UDP:
 #if IS_ENABLED(CONFIG_IPV6)
                 if (cfg->local_ip6 && cfg->peer_ip6) {
-                        err = sock_create(AF_INET6, SOCK_DGRAM, 0, sockp);
+                        err = sock_create_kern(AF_INET6, SOCK_DGRAM, 0, &sock);
                         if (err < 0)
                                 goto out;
 
-                        sock = *sockp;
+                        sk_change_net(sock->sk, net);
 
-                        memset(&udp6_addr, 0, sizeof(udp6_addr));
                         udp6_addr.sin6_family = AF_INET6;
                         memcpy(&udp6_addr.sin6_addr, cfg->local_ip6,
                                sizeof(udp6_addr.sin6_addr));
@@ -1400,13 +1474,12 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
                 } else
 #endif
                 {
-                        err = sock_create(AF_INET, SOCK_DGRAM, 0, sockp);
+                        err = sock_create_kern(AF_INET, SOCK_DGRAM, 0, &sock);
                         if (err < 0)
                                 goto out;
 
-                        sock = *sockp;
+                        sk_change_net(sock->sk, net);
 
-                        memset(&udp_addr, 0, sizeof(udp_addr));
                         udp_addr.sin_family = AF_INET;
                         udp_addr.sin_addr = cfg->local_ip;
                         udp_addr.sin_port = htons(cfg->local_udp_port);
@@ -1433,14 +1506,13 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
         case L2TP_ENCAPTYPE_IP:
 #if IS_ENABLED(CONFIG_IPV6)
                 if (cfg->local_ip6 && cfg->peer_ip6) {
-                        err = sock_create(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP,
-                                          sockp);
+                        err = sock_create_kern(AF_INET6, SOCK_DGRAM,
+                                          IPPROTO_L2TP, &sock);
                         if (err < 0)
                                 goto out;
 
-                        sock = *sockp;
+                        sk_change_net(sock->sk, net);
 
-                        memset(&ip6_addr, 0, sizeof(ip6_addr));
                         ip6_addr.l2tp_family = AF_INET6;
                         memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
                                sizeof(ip6_addr.l2tp_addr));
@@ -1462,14 +1534,13 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
                 } else
 #endif
                 {
-                        err = sock_create(AF_INET, SOCK_DGRAM, IPPROTO_L2TP,
-                                          sockp);
+                        err = sock_create_kern(AF_INET, SOCK_DGRAM,
+                                          IPPROTO_L2TP, &sock);
                         if (err < 0)
                                 goto out;
 
-                        sock = *sockp;
+                        sk_change_net(sock->sk, net);
 
-                        memset(&ip_addr, 0, sizeof(ip_addr));
                         ip_addr.l2tp_family = AF_INET;
                         ip_addr.l2tp_addr = cfg->local_ip;
                         ip_addr.l2tp_conn_id = tunnel_id;
@@ -1493,8 +1564,10 @@ static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2t
         }
 
 out:
+        *sockp = sock;
         if ((err < 0) && sock) {
-                sock_release(sock);
+                kernel_sock_shutdown(sock, SHUT_RDWR);
+                sk_release_kernel(sock->sk);
                 *sockp = NULL;
         }
 
@@ -1517,15 +1590,23 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
          * kernel socket.
          */
         if (fd < 0) {
-                err = l2tp_tunnel_sock_create(tunnel_id, peer_tunnel_id, cfg, &sock);
+                err = l2tp_tunnel_sock_create(net, tunnel_id, peer_tunnel_id,
+                                cfg, &sock);
                 if (err < 0)
                         goto err;
         } else {
-                err = -EBADF;
                 sock = sockfd_lookup(fd, &err);
                 if (!sock) {
-                        pr_err("tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
+                        pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
                                tunnel_id, fd, err);
+                        err = -EBADF;
+                        goto err;
+                }
+
+                /* Reject namespace mismatches */
+                if (!net_eq(sock_net(sock->sk), net)) {
+                        pr_err("tunl %u: netns mismatch\n", tunnel_id);
+                        err = -EINVAL;
                         goto err;
                 }
         }
@@ -1607,10 +1688,14 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         tunnel->old_sk_destruct = sk->sk_destruct;
         sk->sk_destruct = &l2tp_tunnel_destruct;
         tunnel->sock = sk;
+        tunnel->fd = fd;
         lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
 
         sk->sk_allocation = GFP_ATOMIC;
 
+        /* Init delete workqueue struct */
+        INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
+
         /* Add tunnel to our list */
         INIT_LIST_HEAD(&tunnel->list);
         atomic_inc(&l2tp_tunnel_count);
@@ -1642,25 +1727,7 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
  */
 int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
 {
-        int err = 0;
-        struct socket *sock = tunnel->sock ? tunnel->sock->sk_socket : NULL;
-
-        /* Force the tunnel socket to close. This will eventually
-         * cause the tunnel to be deleted via the normal socket close
-         * mechanisms when userspace closes the tunnel socket.
-         */
-        if (sock != NULL) {
-                err = inet_shutdown(sock, 2);
-
-                /* If the tunnel's socket was created by the kernel,
-                 * close the socket here since the socket was not
-                 * created by userspace.
-                 */
-                if (sock->file == NULL)
-                        err = inet_release(sock);
-        }
-
-        return err;
+        return (false == queue_work(l2tp_wq, &tunnel->del_work));
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
 
@@ -1844,8 +1911,21 @@ static __net_init int l2tp_init_net(struct net *net)
         return 0;
 }
 
+static __net_exit void l2tp_exit_net(struct net *net)
+{
+        struct l2tp_net *pn = l2tp_pernet(net);
+        struct l2tp_tunnel *tunnel = NULL;
+
+        rcu_read_lock_bh();
+        list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
+                (void)l2tp_tunnel_delete(tunnel);
+        }
+        rcu_read_unlock_bh();
+}
+
 static struct pernet_operations l2tp_net_ops = {
         .init = l2tp_init_net,
+        .exit = l2tp_exit_net,
         .id   = &l2tp_net_id,
         .size = sizeof(struct l2tp_net),
 };
@@ -1858,6 +1938,13 @@ static int __init l2tp_init(void)
         if (rc)
                 goto out;
 
+        l2tp_wq = alloc_workqueue("l2tp", WQ_NON_REENTRANT | WQ_UNBOUND, 0);
+        if (!l2tp_wq) {
+                pr_err("alloc_workqueue failed\n");
+                rc = -ENOMEM;
+                goto out;
+        }
+
         pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
 
 out:
@@ -1867,6 +1954,10 @@ out:
 static void __exit l2tp_exit(void)
 {
         unregister_pernet_device(&l2tp_net_ops);
+        if (l2tp_wq) {
+                destroy_workqueue(l2tp_wq);
+                l2tp_wq = NULL;
+        }
 }
 
 module_init(l2tp_init);
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 56d583e083a7..8eb8f1d47f3a 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -188,7 +188,10 @@ struct l2tp_tunnel {
         int (*recv_payload_hook)(struct sk_buff *skb);
         void (*old_sk_destruct)(struct sock *);
         struct sock             *sock;          /* Parent socket */
-        int                     fd;
+        int                     fd;             /* Parent fd, if tunnel socket
+                                                 * was created by userspace */
+
+        struct work_struct      del_work;
 
         uint8_t                 priv[0];        /* private data */
 };
@@ -228,6 +231,8 @@ out:
         return tunnel;
 }
 
+extern struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel);
+extern void l2tp_tunnel_sock_put(struct sock *sk);
 extern struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id);
 extern struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth);
 extern struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname);
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 61d8b75d2686..f7ac8f42fee2 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -115,6 +115,7 @@ static inline struct sock *l2tp_ip_bind_lookup(struct net *net, __be32 laddr, in
  */
 static int l2tp_ip_recv(struct sk_buff *skb)
 {
+        struct net *net = dev_net(skb->dev);
         struct sock *sk;
         u32 session_id;
         u32 tunnel_id;
@@ -142,7 +143,7 @@ static int l2tp_ip_recv(struct sk_buff *skb)
         }
 
         /* Ok, this is a data packet. Lookup the session. */
-        session = l2tp_session_find(&init_net, NULL, session_id);
+        session = l2tp_session_find(net, NULL, session_id);
         if (session == NULL)
                 goto discard;
 
@@ -173,14 +174,14 @@ pass_up:
                 goto discard;
 
         tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
-        tunnel = l2tp_tunnel_find(&init_net, tunnel_id);
+        tunnel = l2tp_tunnel_find(net, tunnel_id);
         if (tunnel != NULL)
                 sk = tunnel->sock;
         else {
                 struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
 
                 read_lock_bh(&l2tp_ip_lock);
-                sk = __l2tp_ip_bind_lookup(&init_net, iph->daddr, 0, tunnel_id);
+                sk = __l2tp_ip_bind_lookup(net, iph->daddr, 0, tunnel_id);
                 read_unlock_bh(&l2tp_ip_lock);
         }
 
@@ -239,6 +240,7 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_l2tpip *addr = (struct sockaddr_l2tpip *) uaddr;
+        struct net *net = sock_net(sk);
         int ret;
         int chk_addr_ret;
 
@@ -251,7 +253,8 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 
         ret = -EADDRINUSE;
         read_lock_bh(&l2tp_ip_lock);
-        if (__l2tp_ip_bind_lookup(&init_net, addr->l2tp_addr.s_addr, sk->sk_bound_dev_if, addr->l2tp_conn_id))
+        if (__l2tp_ip_bind_lookup(net, addr->l2tp_addr.s_addr,
+                                  sk->sk_bound_dev_if, addr->l2tp_conn_id))
                 goto out_in_use;
 
         read_unlock_bh(&l2tp_ip_lock);
@@ -260,7 +263,7 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_l2tpip))
                 goto out;
 
-        chk_addr_ret = inet_addr_type(&init_net, addr->l2tp_addr.s_addr);
+        chk_addr_ret = inet_addr_type(net, addr->l2tp_addr.s_addr);
         ret = -EADDRNOTAVAIL;
         if (addr->l2tp_addr.s_addr && chk_addr_ret != RTN_LOCAL &&
             chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
@@ -369,7 +372,7 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
         return 0;
 
 drop:
-        IP_INC_STATS(&init_net, IPSTATS_MIB_INDISCARDS);
+        IP_INC_STATS(sock_net(sk), IPSTATS_MIB_INDISCARDS);
         kfree_skb(skb);
         return -1;
 }
@@ -605,6 +608,7 @@ static struct inet_protosw l2tp_ip_protosw = {
 
 static struct net_protocol l2tp_ip_protocol __read_mostly = {
         .handler        = l2tp_ip_recv,
+        .netns_ok       = 1,
 };
 
 static int __init l2tp_ip_init(void)
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 927547171bc7..8ee4a86ae996 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -554,8 +554,8 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(struct ipv6_txoptions);
 
-                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &hlimit, &tclass, &dontfrag);
+                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
+                                            &hlimit, &tclass, &dontfrag);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -646,7 +646,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                             struct msghdr *msg, size_t len, int noblock,
                             int flags, int *addr_len)
 {
-        struct inet_sock *inet = inet_sk(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
         struct sockaddr_l2tpip6 *lsa = (struct sockaddr_l2tpip6 *)msg->msg_name;
         size_t copied = 0;
         int err = -EOPNOTSUPP;
@@ -688,8 +688,8 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                         lsa->l2tp_scope_id = IP6CB(skb)->iif;
         }
 
-        if (inet->cmsg_flags)
-                ip_cmsg_recv(msg, skb);
+        if (np->rxopt.all)
+                ip6_datagram_recv_ctl(sk, msg, skb);
 
         if (flags & MSG_TRUNC)
                 copied = skb->len;
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index bbba3a19e944..c1bab22db85e 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -37,6 +37,7 @@ static struct genl_family l2tp_nl_family = {
         .version        = L2TP_GENL_VERSION,
         .hdrsize        = 0,
         .maxattr        = L2TP_ATTR_MAX,
+        .netnsok        = true,
 };
 
 /* Accessed under genl lock */
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 286366ef8930..3f4e3afc191a 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -388,8 +388,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         struct l2tp_session *session;
         struct l2tp_tunnel *tunnel;
         struct pppol2tp_session *ps;
-        int old_headroom;
-        int new_headroom;
         int uhlen, headroom;
 
         if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
@@ -408,7 +406,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         if (tunnel == NULL)
                 goto abort_put_sess;
 
-        old_headroom = skb_headroom(skb);
         uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
         headroom = NET_SKB_PAD +
                    sizeof(struct iphdr) + /* IP header */
@@ -418,9 +415,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         if (skb_cow_head(skb, headroom))
                 goto abort_put_sess_tun;
 
-        new_headroom = skb_headroom(skb);
-        skb->truesize += new_headroom - old_headroom;
-
         /* Setup PPP header */
         __skb_push(skb, sizeof(ppph));
         skb->data[0] = ppph[0];
@@ -1789,7 +1783,8 @@ static __net_init int pppol2tp_init_net(struct net *net)
         struct proc_dir_entry *pde;
         int err = 0;
 
-        pde = proc_net_fops_create(net, "pppol2tp", S_IRUGO, &pppol2tp_proc_fops);
+        pde = proc_create("pppol2tp", S_IRUGO, net->proc_net,
+                          &pppol2tp_proc_fops);
         if (!pde) {
                 err = -ENOMEM;
                 goto out;
@@ -1801,7 +1796,7 @@ out:
 
 static __net_exit void pppol2tp_exit_net(struct net *net)
 {
-        proc_net_remove(net, "pppol2tp");
+        remove_proc_entry("pppol2tp", net->proc_net);
 }
 
 static struct pernet_operations pppol2tp_net_ops = {