• Jon Paul Maloy's avatar
    tipc: unclone unbundled buffers before forwarding · 27777daa
    Jon Paul Maloy authored
    When extracting an individual message from a received "bundle" buffer,
    we just create a clone of the base buffer, and adjust it to point into
    the right position of the linearized data area of the latter. This works
    well for regular message reception, but during periods of extremely high
    load it may happen that an extracted buffer, e.g, a connection probe, is
    reversed and forwarded through an external interface while the preceding
    extracted message is still unhandled. When this happens, the header or
    data area of the preceding message will be partially overwritten by a
    MAC header, leading to unpredicatable consequences, such as a link
    We now fix this by ensuring that the msg_reverse() function never
    returns a cloned buffer, and that the returned buffer always contains
    sufficient valid head and tail room to be forwarded.
    Reported-by: default avatarErik Hugne <erik.hugne@gmail.com>
    Acked-by: default avatarYing Xue <ying.xue@windriver.com>
    Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
msg.c 17.1 KB