[net-next,4/8] tipc: mark head of reassembly buffer as non-linear

Submitted by Jon Paul Maloy on May 9, 2014, 1:13 p.m.


Message ID 1399641209-26112-5-git-send-email-jon.maloy@ericsson.com
State Changes Requested
Delegated to: David Miller
Headers show

Commit Message

Jon Paul Maloy May 9, 2014, 1:13 p.m.
The message reassembly function does not update the 'len' and 'data_len'
fields of the head skbuff correctly when fragments are chained to it.
This may sometimes lead to obsure errors, such as fragment reordering
when we receive fragments which are cloned buffers.

This commit fixes this, by ensuring that the two fields are updated

Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Reviewed-by: Ying Xue <ying.xue@windriver.com>
 net/tipc/link.c |    2 ++
 1 file changed, 2 insertions(+)

Patch hide | download patch | download mbox

diff --git a/net/tipc/link.c b/net/tipc/link.c
index 6cf7938..9272d4c 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -2341,6 +2341,8 @@  int tipc_link_frag_rcv(struct sk_buff **head, struct sk_buff **tail,
 			(*tail)->next = frag;
 		*tail = frag;
 		(*head)->truesize += frag->truesize;
+		(*head)->data_len += frag->len;
+		(*head)->len += frag->len;
 	if (fragid == LAST_FRAGMENT) {
 		*fbuf = *head;