Commit 5074ab89 authored by Jon Paul Maloy's avatar Jon Paul Maloy Committed by David S. Miller

tipc: mark head of reassembly buffer as non-linear

The message reassembly function does not update the 'len' and 'data_len'
fields of the head skbuff correctly when fragments are chained to it.
This may sometimes lead to obsure errors, such as fragment reordering
when we receive fragments which are cloned buffers.

This commit fixes this, by ensuring that the two fields are updated
correctly.
Suggested-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Reviewed-by: default avatarYing Xue <ying.xue@windriver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ec37dcd3
...@@ -2341,6 +2341,8 @@ int tipc_link_frag_rcv(struct sk_buff **head, struct sk_buff **tail, ...@@ -2341,6 +2341,8 @@ int tipc_link_frag_rcv(struct sk_buff **head, struct sk_buff **tail,
(*tail)->next = frag; (*tail)->next = frag;
*tail = frag; *tail = frag;
(*head)->truesize += frag->truesize; (*head)->truesize += frag->truesize;
(*head)->data_len += frag->len;
(*head)->len += frag->len;
} }
if (fragid == LAST_FRAGMENT) { if (fragid == LAST_FRAGMENT) {
*fbuf = *head; *fbuf = *head;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment