Commit 5074ab89 authored May 14, 2014 by Jon Paul Maloy Committed by David S. Miller May 14, 2014

tipc: mark head of reassembly buffer as non-linear



The message reassembly function does not update the 'len' and 'data_len'
fields of the head skbuff correctly when fragments are chained to it.
This may sometimes lead to obsure errors, such as fragment reordering
when we receive fragments which are cloned buffers.

This commit fixes this, by ensuring that the two fields are updated
correctly.

Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Reviewed-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent ec37dcd3

net/tipc/link.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -2341,6 +2341,8 @@ int tipc_link_frag_rcv(struct sk_buff head, struct sk_buff tail,
		(*tail)->next = frag;
		*tail = frag;
		(*head)->truesize += frag->truesize;
		(*head)->data_len += frag->len;
		(*head)->len += frag->len;
		}
		if (fragid == LAST_FRAGMENT) {
		fbuf = head;

Admin message