diff options
| -rw-r--r-- | net/tipc/core.h | 12 | ||||
| -rw-r--r-- | net/tipc/link.c | 6 |
2 files changed, 18 insertions, 0 deletions
diff --git a/net/tipc/core.h b/net/tipc/core.h index b3c9df385bb..325404fd4eb 100644 --- a/net/tipc/core.h +++ b/net/tipc/core.h @@ -337,4 +337,16 @@ static inline void buf_discard(struct sk_buff *skb) kfree_skb(skb); } +/** + * buf_linearize - convert a TIPC message buffer into a single contiguous piece + * @skb: message buffer + * + * Returns 0 on success. + */ + +static inline int buf_linearize(struct sk_buff *skb) +{ + return skb_linearize(skb); +} + #endif diff --git a/net/tipc/link.c b/net/tipc/link.c index a42f4343010..087379366d3 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -1811,6 +1811,12 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr) #endif msg_dbg(msg,"<REC<"); + /* Ensure message data is a single contiguous unit */ + + if (unlikely(buf_linearize(buf))) { + goto cont; + } + if (unlikely(msg_non_seq(msg))) { link_recv_non_seq(buf); continue; |