浏览代码

tipc: mark head of reassembly buffer as non-linear

The message reassembly function does not update the 'len' and 'data_len'
fields of the head skbuff correctly when fragments are chained to it.
This may sometimes lead to obsure errors, such as fragment reordering
when we receive fragments which are cloned buffers.

This commit fixes this, by ensuring that the two fields are updated
correctly.

Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Reviewed-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jon Paul Maloy 11 年之前
父节点
当前提交
5074ab89c5
共有 1 个文件被更改,包括 2 次插入0 次删除
  1. 2 0
      net/tipc/link.c

+ 2 - 0
net/tipc/link.c

@@ -2341,6 +2341,8 @@ int tipc_link_frag_rcv(struct sk_buff **head, struct sk_buff **tail,
 			(*tail)->next = frag;
 			(*tail)->next = frag;
 		*tail = frag;
 		*tail = frag;
 		(*head)->truesize += frag->truesize;
 		(*head)->truesize += frag->truesize;
+		(*head)->data_len += frag->len;
+		(*head)->len += frag->len;
 	}
 	}
 	if (fragid == LAST_FRAGMENT) {
 	if (fragid == LAST_FRAGMENT) {
 		*fbuf = *head;
 		*fbuf = *head;