tipc: fix message corruption bug for deferred packets
authorErik Hugne <erik.hugne@ericsson.com>
Tue, 11 Feb 2014 10:38:26 +0000 (11:38 +0100)
committerDavid S. Miller <davem@davemloft.net>
Thu, 13 Feb 2014 21:35:05 +0000 (16:35 -0500)
If a packet received on a link is out-of-sequence, it will be
placed on a deferred queue and later reinserted in the receive
path once the preceding packets have been processed. The problem
with this is that it will be subject to the buffer adjustment from
link_recv_buf_validate twice. The second adjustment for 20 bytes
header space will corrupt the packet.

We solve this by tagging the deferred packets and bail out from
receive buffer validation for packets that have already been
subjected to this.

Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Reviewed-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tipc/core.h
net/tipc/link.c

diff --cc net/tipc/core.h
Simple merge
diff --cc net/tipc/link.c
Simple merge