}
 EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
 
-/* Lookup a session. A new reference is held on the returned session.
- * Optionally calls session->ref() too if do_ref is true.
- */
+/* Lookup a session. A new reference is held on the returned session. */
 struct l2tp_session *l2tp_session_get(const struct net *net,
                                      struct l2tp_tunnel *tunnel,
-                                     u32 session_id, bool do_ref)
+                                     u32 session_id)
 {
        struct hlist_head *session_list;
        struct l2tp_session *session;
                hlist_for_each_entry_rcu(session, session_list, global_hlist) {
                        if (session->session_id == session_id) {
                                l2tp_session_inc_refcount(session);
-                               if (do_ref && session->ref)
-                                       session->ref(session);
                                rcu_read_unlock_bh();
 
                                return session;
        hlist_for_each_entry(session, session_list, hlist) {
                if (session->session_id == session_id) {
                        l2tp_session_inc_refcount(session);
-                       if (do_ref && session->ref)
-                               session->ref(session);
                        read_unlock_bh(&tunnel->hlist_lock);
 
                        return session;
 }
 EXPORT_SYMBOL_GPL(l2tp_session_get);
 
-struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
-                                         bool do_ref)
+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth)
 {
        int hash;
        struct l2tp_session *session;
                hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
                        if (++count > nth) {
                                l2tp_session_inc_refcount(session);
-                               if (do_ref && session->ref)
-                                       session->ref(session);
                                read_unlock_bh(&tunnel->hlist_lock);
                                return session;
                        }
  * This is very inefficient but is only used by management interfaces.
  */
 struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
-                                               const char *ifname,
-                                               bool do_ref)
+                                               const char *ifname)
 {
        struct l2tp_net *pn = l2tp_pernet(net);
        int hash;
                hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
                        if (!strcmp(session->ifname, ifname)) {
                                l2tp_session_inc_refcount(session);
-                               if (do_ref && session->ref)
-                                       session->ref(session);
                                rcu_read_unlock_bh();
 
                                return session;
                (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
        else
                kfree_skb(skb);
-
-       if (session->deref)
-               (*session->deref)(session);
 }
 
 /* Dequeue skbs from the session's reorder_q, subject to packet order.
                        session->reorder_skip = 1;
                        __skb_unlink(skb, &session->reorder_q);
                        kfree_skb(skb);
-                       if (session->deref)
-                               (*session->deref)(session);
                        continue;
                }
 
  * a data (not control) frame before coming here. Fields up to the
  * session-id have already been parsed and ptr points to the data
  * after the session-id.
- *
- * session->ref() must have been called prior to l2tp_recv_common().
- * session->deref() will be called automatically after skb is processed.
  */
 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                      unsigned char *ptr, unsigned char *optr, u16 hdrflags,
 discard:
        atomic_long_inc(&session->stats.rx_errors);
        kfree_skb(skb);
-
-       if (session->deref)
-               (*session->deref)(session);
 }
 EXPORT_SYMBOL(l2tp_recv_common);
 
        while ((skb = skb_dequeue(&session->reorder_q))) {
                atomic_long_inc(&session->stats.rx_errors);
                kfree_skb(skb);
-               if (session->deref)
-                       (*session->deref)(session);
        }
        return 0;
 }
        }
 
        /* Find the session context */
-       session = l2tp_session_get(tunnel->l2tp_net, tunnel, session_id, true);
+       session = l2tp_session_get(tunnel->l2tp_net, tunnel, session_id);
        if (!session || !session->recv_skb) {
-               if (session) {
-                       if (session->deref)
-                               session->deref(session);
+               if (session)
                        l2tp_session_dec_refcount(session);
-               }
 
                /* Not found? Pass to userspace to deal with */
                l2tp_info(tunnel, L2TP_MSG_DATA,
                        if (test_and_set_bit(0, &session->dead))
                                goto again;
 
-                       if (session->ref != NULL)
-                               (*session->ref)(session);
-
                        write_unlock_bh(&tunnel->hlist_lock);
 
                        __l2tp_session_unhash(session);
                        if (session->session_close != NULL)
                                (*session->session_close)(session);
 
-                       if (session->deref != NULL)
-                               (*session->deref)(session);
-
                        l2tp_session_dec_refcount(session);
 
                        write_lock_bh(&tunnel->hlist_lock);
        if (test_and_set_bit(0, &session->dead))
                return 0;
 
-       if (session->ref)
-               (*session->ref)(session);
        __l2tp_session_unhash(session);
        l2tp_session_queue_purge(session);
        if (session->session_close != NULL)
                (*session->session_close)(session);
-       if (session->deref)
-               (*session->deref)(session);
+
        l2tp_session_dec_refcount(session);
+
        return 0;
 }
 EXPORT_SYMBOL_GPL(l2tp_session_delete);
 
        int (*build_header)(struct l2tp_session *session, void *buf);
        void (*recv_skb)(struct l2tp_session *session, struct sk_buff *skb, int data_len);
        void (*session_close)(struct l2tp_session *session);
-       void (*ref)(struct l2tp_session *session);
-       void (*deref)(struct l2tp_session *session);
 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
        void (*show)(struct seq_file *m, void *priv);
 #endif
 
 struct l2tp_session *l2tp_session_get(const struct net *net,
                                      struct l2tp_tunnel *tunnel,
-                                     u32 session_id, bool do_ref);
-struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
-                                         bool do_ref);
+                                     u32 session_id);
+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth);
 struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
-                                               const char *ifname,
-                                               bool do_ref);
+                                               const char *ifname);
 struct l2tp_tunnel *l2tp_tunnel_find(const struct net *net, u32 tunnel_id);
 struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth);
 
 
 
 static void l2tp_dfs_next_session(struct l2tp_dfs_seq_data *pd)
 {
-       pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
+       pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx);
        pd->session_idx++;
 
        if (pd->session == NULL) {
                l2tp_dfs_seq_tunnel_show(m, pd->tunnel);
        } else {
                l2tp_dfs_seq_session_show(m, pd->session);
-               if (pd->session->deref)
-                       pd->session->deref(pd->session);
                l2tp_session_dec_refcount(pd->session);
        }
 
 
        }
 
        /* Ok, this is a data packet. Lookup the session. */
-       session = l2tp_session_get(net, NULL, session_id, true);
+       session = l2tp_session_get(net, NULL, session_id);
        if (!session)
                goto discard;
 
        return sk_receive_skb(sk, skb, 1);
 
 discard_sess:
-       if (session->deref)
-               session->deref(session);
        l2tp_session_dec_refcount(session);
        goto discard;
 
 
        }
 
        /* Ok, this is a data packet. Lookup the session. */
-       session = l2tp_session_get(net, NULL, session_id, true);
+       session = l2tp_session_get(net, NULL, session_id);
        if (!session)
                goto discard;
 
        return sk_receive_skb(sk, skb, 1);
 
 discard_sess:
-       if (session->deref)
-               session->deref(session);
        l2tp_session_dec_refcount(session);
        goto discard;
 
 
 /* Accessed under genl lock */
 static const struct l2tp_nl_cmd_ops *l2tp_nl_cmd_ops[__L2TP_PWTYPE_MAX];
 
-static struct l2tp_session *l2tp_nl_session_get(struct genl_info *info,
-                                               bool do_ref)
+static struct l2tp_session *l2tp_nl_session_get(struct genl_info *info)
 {
        u32 tunnel_id;
        u32 session_id;
 
        if (info->attrs[L2TP_ATTR_IFNAME]) {
                ifname = nla_data(info->attrs[L2TP_ATTR_IFNAME]);
-               session = l2tp_session_get_by_ifname(net, ifname, do_ref);
+               session = l2tp_session_get_by_ifname(net, ifname);
        } else if ((info->attrs[L2TP_ATTR_SESSION_ID]) &&
                   (info->attrs[L2TP_ATTR_CONN_ID])) {
                tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]);
                session_id = nla_get_u32(info->attrs[L2TP_ATTR_SESSION_ID]);
                tunnel = l2tp_tunnel_get(net, tunnel_id);
                if (tunnel) {
-                       session = l2tp_session_get(net, tunnel, session_id,
-                                                  do_ref);
+                       session = l2tp_session_get(net, tunnel, session_id);
                        l2tp_tunnel_dec_refcount(tunnel);
                }
        }
                                                           &cfg);
 
        if (ret >= 0) {
-               session = l2tp_session_get(net, tunnel, session_id, false);
+               session = l2tp_session_get(net, tunnel, session_id);
                if (session) {
                        ret = l2tp_session_notify(&l2tp_nl_family, info, session,
                                                  L2TP_CMD_SESSION_CREATE);
        struct l2tp_session *session;
        u16 pw_type;
 
-       session = l2tp_nl_session_get(info, true);
+       session = l2tp_nl_session_get(info);
        if (session == NULL) {
                ret = -ENODEV;
                goto out;
                if (l2tp_nl_cmd_ops[pw_type] && l2tp_nl_cmd_ops[pw_type]->session_delete)
                        ret = (*l2tp_nl_cmd_ops[pw_type]->session_delete)(session);
 
-       if (session->deref)
-               session->deref(session);
        l2tp_session_dec_refcount(session);
 
 out:
        int ret = 0;
        struct l2tp_session *session;
 
-       session = l2tp_nl_session_get(info, false);
+       session = l2tp_nl_session_get(info);
        if (session == NULL) {
                ret = -ENODEV;
                goto out;
        struct sk_buff *msg;
        int ret;
 
-       session = l2tp_nl_session_get(info, false);
+       session = l2tp_nl_session_get(info);
        if (session == NULL) {
                ret = -ENODEV;
                goto err;
                                goto out;
                }
 
-               session = l2tp_session_get_nth(tunnel, si, false);
+               session = l2tp_session_get_nth(tunnel, si);
                if (session == NULL) {
                        ti++;
                        tunnel = NULL;
 
        if (tunnel->peer_tunnel_id == 0)
                tunnel->peer_tunnel_id = peer_tunnel_id;
 
-       session = l2tp_session_get(sock_net(sk), tunnel, session_id, false);
+       session = l2tp_session_get(sock_net(sk), tunnel, session_id);
        if (session) {
                drop_refcnt = true;
                ps = l2tp_session_priv(session);
                        /* resend to session ioctl handler */
                        struct l2tp_session *session =
                                l2tp_session_get(sock_net(sk), tunnel,
-                                                stats.session_id, true);
+                                                stats.session_id);
 
                        if (session) {
                                err = pppol2tp_session_ioctl(session, cmd,
                                                             arg);
-                               if (session->deref)
-                                       session->deref(session);
                                l2tp_session_dec_refcount(session);
                        } else {
                                err = -EBADR;
 
 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
 {
-       pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
+       pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx);
        pd->session_idx++;
 
        if (pd->session == NULL) {
                pppol2tp_seq_tunnel_show(m, pd->tunnel);
        } else {
                pppol2tp_seq_session_show(m, pd->session);
-               if (pd->session->deref)
-                       pd->session->deref(pd->session);
                l2tp_session_dec_refcount(pd->session);
        }