summaryrefslogtreecommitdiff
path: root/net/tipc
diff options
context:
space:
mode:
authorJon Paul Maloy <jon.maloy@ericsson.com>2014-05-14 13:39:11 +0400
committerDavid S. Miller <davem@davemloft.net>2014-05-14 23:19:48 +0400
commit5074ab89c555dd130ceeac129546670423d634b8 (patch)
treeb4f5a56a3c2e8eecfec5465491bb6f79f596ac77 /net/tipc
parentec37dcd382b4f3673bfbf36ccd348ef48f98ffe3 (diff)
downloadlinux-5074ab89c555dd130ceeac129546670423d634b8.tar.xz
tipc: mark head of reassembly buffer as non-linear
The message reassembly function does not update the 'len' and 'data_len' fields of the head skbuff correctly when fragments are chained to it. This may sometimes lead to obsure errors, such as fragment reordering when we receive fragments which are cloned buffers. This commit fixes this, by ensuring that the two fields are updated correctly. Suggested-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Jon Maloy <jon.maloy@ericsson.com> Reviewed-by: Ying Xue <ying.xue@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc')
-rw-r--r--net/tipc/link.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 6cf7938784c6..9272d4cc0225 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -2341,6 +2341,8 @@ int tipc_link_frag_rcv(struct sk_buff **head, struct sk_buff **tail,
(*tail)->next = frag;
*tail = frag;
(*head)->truesize += frag->truesize;
+ (*head)->data_len += frag->len;
+ (*head)->len += frag->len;
}
if (fragid == LAST_FRAGMENT) {
*fbuf = *head;