aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--net/tipc/core.h12
-rw-r--r--net/tipc/link.c6
2 files changed, 18 insertions, 0 deletions
diff --git a/net/tipc/core.h b/net/tipc/core.h
index b3c9df385bb..325404fd4eb 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -337,4 +337,16 @@ static inline void buf_discard(struct sk_buff *skb)
kfree_skb(skb);
}
+/**
+ * buf_linearize - convert a TIPC message buffer into a single contiguous piece
+ * @skb: message buffer
+ *
+ * Returns 0 on success.
+ */
+
+static inline int buf_linearize(struct sk_buff *skb)
+{
+ return skb_linearize(skb);
+}
+
#endif
diff --git a/net/tipc/link.c b/net/tipc/link.c
index a42f4343010..087379366d3 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1811,6 +1811,12 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr)
#endif
msg_dbg(msg,"<REC<");
+ /* Ensure message data is a single contiguous unit */
+
+ if (unlikely(buf_linearize(buf))) {
+ goto cont;
+ }
+
if (unlikely(msg_non_seq(msg))) {
link_recv_non_seq(buf);
continue;