linux/net/tipc
Jon Paul Maloy f0f998cc4b tipc: clear 'next'-pointer of message fragments before reassembly
[ Upstream commit 999417549c ]

If the 'next' pointer of the last fragment buffer in a message is not
zeroed before reassembly, we risk ending up with a corrupt message,
since the reassembly function itself isn't doing this.

Currently, when a buffer is retrieved from the deferred queue of the
broadcast link, the next pointer is not cleared, with the result as
described above.

This commit corrects this, and thereby fixes a bug that may occur when
long broadcast messages are transmitted across dual interfaces. The bug
has been present since 40ba3cdf54 ("tipc:
message reassembly using fragment chain")

This commit should be applied to both net and net-next.

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-07-28 08:06:01 -07:00
..
Kconfig tipc: add InfiniBand media type 2013-04-17 14:18:33 -04:00
Makefile tipc: introduce new TIPC server infrastructure 2013-06-17 15:53:00 -07:00
addr.c tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
addr.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
bcast.c tipc: clear 'next'-pointer of message fragments before reassembly 2014-07-28 08:06:01 -07:00
bcast.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
bearer.c tipc: make bearer set up in module insertion stage 2014-02-22 00:00:15 -05:00
bearer.h tipc: rename functions related to link failover and improve comments 2014-01-07 18:44:25 -05:00
config.c tipc: allow connection shutdown callback to be invoked in advance 2014-03-06 14:46:23 -05:00
config.h tipc: Optimize re-initialization of configuration service 2012-04-26 17:19:07 -04:00
core.c tipc: make bearer set up in module insertion stage 2014-02-22 00:00:15 -05:00
core.h tipc: make bearer set up in module insertion stage 2014-02-22 00:00:15 -05:00
discover.c tipc: introduce new spinlock to protect struct link_req 2014-01-07 18:44:25 -05:00
discover.h tipc: rename struct link* to struct tipc_link* 2011-12-29 21:53:30 -05:00
eth_media.c tipc: eliminate code duplication in media layer 2013-12-11 00:17:43 -05:00
handler.c tipc: don't log disabled tasklet handler errors 2014-03-06 14:46:24 -05:00
ib_media.c tipc: eliminate code duplication in media layer 2013-12-11 00:17:43 -05:00
link.c tipc: fix message corruption bug for deferred packets 2014-02-13 16:35:05 -05:00
link.h tipc: make link start event synchronous 2014-01-07 18:44:26 -05:00
log.c tipc: remove print_buf and deprecated log buffer code 2012-07-13 19:34:43 -04:00
msg.c tipc: remove iovec length parameter from all sending functions 2013-10-18 13:20:42 -04:00
msg.h tipc: message reassembly using fragment chain 2013-11-07 18:30:11 -05:00
name_distr.c tipc: eliminate an unnecessary cast of node variable 2012-11-22 14:33:28 -05:00
name_distr.h [NET] TIPC: Fix whitespace errors. 2007-02-10 23:20:15 -08:00
name_table.c tipc: fix memory leak during module removal 2014-03-06 14:46:24 -05:00
name_table.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
net.c tipc: change tipc_net_start routine return value type 2012-08-20 02:26:30 -07:00
net.h tipc: change tipc_net_start routine return value type 2012-08-20 02:26:30 -07:00
netlink.c net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:15:38 -04:00
node.c tipc: rename functions related to link failover and improve comments 2014-01-07 18:44:25 -05:00
node.h tipc: remove 'has_redundant_link' flag from STATE link protocol messages 2014-01-07 18:44:25 -05:00
node_subscr.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
node_subscr.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
port.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-01-06 17:37:45 -05:00
port.h tipc: fix deadlock during socket release 2013-12-29 22:24:07 -05:00
ref.c tipc: remove all enabled flags from all tipc components 2014-02-22 00:00:15 -05:00
ref.h tipc: cleanup function namespace 2010-10-16 11:13:24 -07:00
server.c tipc: fix connection refcount leak 2014-03-06 14:46:23 -05:00
server.h tipc: remove all enabled flags from all tipc components 2014-02-22 00:00:15 -05:00
socket.c tipc: avoid to unnecessary process switch under non-block mode 2014-03-06 14:46:23 -05:00
subscr.c tipc: fix spinlock recursion bug for failed subscriptions 2014-03-24 15:36:56 -04:00
subscr.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
sysctl.c tipc: change socket buffer overflow control to respect sk_rcvbuf 2013-06-17 15:53:00 -07:00