Commit 03b92017 authored by Jon Paul Maloy's avatar Jon Paul Maloy Committed by David S. Miller
Browse files

tipc: stricter behavior of message reassembly function 



The function tipc_link_recv_fragment(struct sk_buff **buf) currently
leaves the value of the input buffer pointer undefined when it returns,
except when the return code indicates that the reassembly is complete.
This despite the fact that it always consumes the input buffer.

Here, we enforce a stricter behavior by this function, ensuring that
the returned buffer pointer is non-NULL if and only if the reassembly
is complete. This makes it possible to test for the buffer pointer as
criteria for successful reassembly.

We also rename the function to tipc_link_frag_rcv(), which is both
shorter and more in line with common naming practice in the network
subsystem.

Apart from the new name, these changes have no impact on current
users of the function, but makes it more practical for use in some
planned future commits.

Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Reviewed-by: default avatarYing Xue <ying.xue@windriver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b3f0f5c3

net/tipc/bcast.c

+3 −3
Original line number Diff line number Diff line
@@ -481,7 +481,7 @@ receive: 
			tipc_link_recv_bundle(buf);

		} else if (msg_user(msg) == MSG_FRAGMENTER) {

			int ret;

			ret = tipc_link_recv_fragment(&node->bclink.reasm_head,

			ret = tipc_link_frag_rcv(&node->bclink.reasm_head,

						 &node->bclink.reasm_tail,

						 &buf);

			if (ret == LINK_REASM_ERROR)

net/tipc/link.c

+9 −7
Original line number Diff line number Diff line
@@ -1584,7 +1584,7 @@ deliver: 
			continue;

		case MSG_FRAGMENTER:

			l_ptr->stats.recv_fragments++;

			ret = tipc_link_recv_fragment(&l_ptr->reasm_head,

			ret = tipc_link_frag_rcv(&l_ptr->reasm_head,

						 &l_ptr->reasm_tail,

						 &buf);

			if (ret == LINK_REASM_COMPLETE) {
@@ -2277,11 +2277,10 @@ static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf) 
	return dsz;

}



/*

 * tipc_link_recv_fragment(): Called with node lock on. Returns

/* tipc_link_frag_rcv(): Called with node lock on. Returns

 * the reassembled buffer if message is complete.

 */

int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail,

int tipc_link_frag_rcv(struct sk_buff **head, struct sk_buff **tail,

		       struct sk_buff **fbuf)

{

	struct sk_buff *frag = *fbuf;
@@ -2296,6 +2295,7 @@ int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail, 
			goto out_free;

		*head = frag;

		skb_frag_list_init(*head);

		*fbuf = NULL;

		return 0;

	} else if (*head &&

		   skb_try_coalesce(*head, frag, &headstolen, &delta)) {
@@ -2315,10 +2315,12 @@ int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail, 
		*tail = *head = NULL;

		return LINK_REASM_COMPLETE;

	}

	*fbuf = NULL;

	return 0;

out_free:

	pr_warn_ratelimited("Link unable to reassemble fragmented message\n");

	kfree_skb(*fbuf);

	*fbuf = NULL;

	return LINK_REASM_ERROR;

}

net/tipc/link.h

+3 −3
Original line number Diff line number Diff line
@@ -239,7 +239,7 @@ int tipc_link_send_sections_fast(struct tipc_port *sender, 
				 struct iovec const *msg_sect,

				 unsigned int len, u32 destnode);

void tipc_link_recv_bundle(struct sk_buff *buf);

int  tipc_link_recv_fragment(struct sk_buff **reasm_head,

int  tipc_link_frag_rcv(struct sk_buff **reasm_head,

			struct sk_buff **reasm_tail,

			struct sk_buff **fbuf);

void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ, int prob,

CRA Git | Maintained and supported by SUSTech CRA and CCSE