From: Jon Paul Maloy <jon.maloy@ericsson.com>
Date: Sat, 5 Jul 2014 17:44:13 +0000 (-0400)
Subject: tipc: fix bug in multicast/broadcast message reassembly
X-Git-Tag: omap-for-v3.17/fixes-against-rc2~289^2~29
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=29322d0db98e5a84f5cc6a55655bee3dc4ffb5ab;p=pandora-kernel.git

tipc: fix bug in multicast/broadcast message reassembly

Since commit 37e22164a8a3c39bdad45aa463b1e69a1fdf4110 ("tipc: rename and
move message reassembly function") reassembly of long broadcast messages
has been broken. This is because we test for a non-NULL return value
of the *buf parameter as criteria for succesful reassembly. However, this
parameter is left defined even after reception of the first fragment,
when reassebly is still incomplete. This leads to a kernel crash as soon
as a the first fragment of a long broadcast message is received.

We fix this with this commit, by implementing a stricter behavior of the
function and its return values.

This commit should be applied to both net and net-next.

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed