l2tp: Fix potential memory corruption in pppol2tp_recvmsg()