tipc: mark head of reassembly buffer as non-linear

The message reassembly function does not update the 'len' and 'data_len'
fields of the head skbuff correctly when fragments are chained to it.
This may sometimes lead to obsure errors, such as fragment reordering
when we receive fragments which are cloned buffers.

This commit fixes this, by ensuring that the two fields are updated
correctly.

Suggested-by: Eric Dumazet <[email protected]>
Signed-off-by: Jon Maloy <[email protected]>
Reviewed-by: Ying Xue <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

diff --git a/net/tipc/link.c b/net/tipc/link.c
index 6cf7938784c64d972befb2a8c5acdd89996d3be3..9272d4cc0225cafa24089d65a1f60d91c56cf9b2 100644 (file)
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -2341,6 +2341,8 @@ int tipc_link_frag_rcv(struct sk_buff **head, struct sk_buff **tail,
                        (*tail)->next = frag;
                *tail = frag;
                (*head)->truesize += frag->truesize;
+               (*head)->data_len += frag->len;
+               (*head)->len += frag->len;
        }
        if (fragid == LAST_FRAGMENT) {
                *fbuf = *head;