--- drivers/net/pppol2tp.c

+++ drivers/net/pppol2tp.c

@@ -756,6 +756,7 @@ static int pppol2tp_recv_core(struct soc

/* Try to dequeue as many skbs from reorder_q as we can. */

pppol2tp_recv_dequeue(session);

+ sock_put(sock);

return 0;

@@ -772,6 +773,7 @@ discard_bad_csum:

UDP_INC_STATS_USER(&init_net, UDP_MIB_INERRORS, 0);

tunnel->stats.rx_errors++;

kfree_skb(skb);

+ sock_put(sock);

return 0;

@@ -1178,7 +1180,8 @@ static int pppol2tp_xmit(struct ppp_chan

/* Calculate UDP checksum if configured to do so */

if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT)

skb->ip_summed = CHECKSUM_NONE;

- else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) {

+ else if ((skb_dst(skb) && skb_dst(skb)->dev) &&

+ (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) {

skb->ip_summed = CHECKSUM_COMPLETE;

csum = skb_checksum(skb, 0, udp_len, 0);

uh->check = csum_tcpudp_magic(inet->saddr, inet->daddr,

@@ -1657,6 +1660,7 @@ static int pppol2tp_connect(struct socke

if (tunnel_sock == NULL)

goto end;

+ sock_hold(tunnel_sock);

tunnel = tunnel_sock->sk_user_data;

} else {

tunnel = pppol2tp_tunnel_find(sock_net(sk), sp->pppol2tp.s_tunnel);