linux/net
Jon Paul Maloy 45c8b7b175 tipc: allow non-linear first fragment buffer
The current code for message reassembly is erroneously assuming that
the the first arriving fragment buffer always is linear, and then goes
ahead resetting the fragment list of that buffer in anticipation of
more arriving fragments.

However, if the buffer already happens to be non-linear, we will
inadvertently drop the already attached fragment list, and later
on trig a BUG() in __pskb_pull_tail().

We see this happen when running fragmented TIPC multicast across UDP,
something made possible since
commit d0f91938be ("tipc: add ip/udp media type")

We fix this by not resetting the fragment list when the buffer is non-
linear, and by initiatlizing our private fragment list tail pointer to
the tail of the existing fragment list.

Fixes: commit d0f91938be ("tipc: add ip/udp media type")
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-10-21 19:08:24 -07:00
..
6lowpan 6lowpan: move module_init into core functionality 2015-08-11 22:05:36 +02:00
9p net/9p: Remove ib_get_dma_mr calls 2015-08-30 18:12:36 -04:00
802
8021q net: 8021q: convert to using IFF_NO_QUEUE 2015-08-18 11:55:06 -07:00
appletalk
atm atm: deal with setting entry before mkip was called 2015-09-17 22:13:32 -07:00
ax25 NET: AX.25: Stop heartbeat timer on disconnect. 2015-07-15 15:59:58 -07:00
batman-adv batman-adv: turn batadv_neigh_node_get() into local function 2015-08-27 20:15:34 +02:00
bluetooth Bluetooth: Fix initializing conn_params in scan phase 2015-10-16 09:24:41 +02:00
bridge bridge: fix igmpv3 / mldv2 report parsing 2015-09-11 15:08:20 -07:00
caif net: caif: convert to using IFF_NO_QUEUE 2015-08-18 11:55:07 -07:00
can can: replace timestamp as unique skb attribute 2015-07-12 21:13:22 +02:00
ceph rbd: use writefull op for object size writes 2015-10-16 16:49:01 +02:00
core ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings 2015-10-14 19:00:20 -07:00
dcb
dccp tcp/dccp: fix timewait races in timer handling 2015-09-21 16:32:29 -07:00
decnet net: ipv6: use common fib_default_rule_pref 2015-09-09 14:19:50 -07:00
dns_resolver
dsa net: dsa: exit probe if no switch were found 2015-10-07 04:56:11 -07:00
ethernet flow_dissector: Add flags argument to skb_flow_dissector functions 2015-09-01 15:06:22 -07:00
hsr net: hsr: convert to using IFF_NO_QUEUE 2015-08-18 11:55:07 -07:00
ieee802154 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next 2015-08-29 13:15:03 -07:00
ipv4 ipv4: fix reply_dst leakage on arp reply 2015-10-05 04:05:15 -07:00
ipv6 net: Really fix vti6 with oif in dst lookups 2015-10-21 19:04:54 -07:00
ipx
irda irda: precedence bug in irlmp_seq_hb_idx() 2015-10-21 07:48:26 -07:00
iucv
key net: Fix RCU splat in af_key 2015-08-24 14:48:10 -07:00
l2tp l2tp: protect tunnel->del_work by ref_count 2015-09-28 22:39:10 -07:00
lapb
llc tcp: fix recv with flags MSG_WAITALL | MSG_PEEK 2015-07-27 01:06:53 -07:00
mac80211 mac80211: Fix hwflags debugfs file format 2015-10-13 10:30:56 +02:00
mac802154 ieee802154: add ack request default handling 2015-08-10 20:43:06 +02:00
mpls mpls: fix mpls_net_init memory leak 2015-08-31 12:45:09 -07:00
netfilter netfilter: nf_log: wait for rcu grace after logger unregistration 2015-09-17 13:37:31 +02:00
netlabel
netlink netlink: Trim skb to alloc size to avoid MSG_TRUNC 2015-10-18 19:34:12 -07:00
netrom netfilter: Remove spurios included of netfilter.h 2015-06-18 21:14:32 +02:00
nfc nfc: netlink: Add capability to reply to vendor_cmd with data 2015-08-20 22:00:11 +02:00
openvswitch openvswitch: Allocate memory for ovs internal device stats. 2015-10-21 19:06:36 -07:00
packet Fix AF_PACKET ABI breakage in 4.2 2015-09-23 14:33:55 -07:00
phonet
rds Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-09-10 13:53:15 -07:00
rfkill rfkill: Copy "all" global state to other types 2015-09-04 14:26:56 +02:00
rose Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-06-24 02:58:51 -07:00
rxrpc
sched sch_hhf: fix return value of hhf_drop() 2015-10-11 04:49:33 -07:00
sctp net: sctp: Don't use 64 kilobyte lookup table for four elements 2015-09-28 22:52:21 -07:00
sunrpc Changes for 4.3-rc5 2015-10-15 13:44:35 -07:00
switchdev switchdev: check if the vlan id is in the proper vlan range 2015-10-13 04:43:24 -07:00
tipc tipc: allow non-linear first fragment buffer 2015-10-21 19:08:24 -07:00
unix net/unix: fix logic about sk_peek_offset 2015-10-05 06:33:09 -07:00
vmw_vsock vsock: fix missing cleanup when misc_register failed 2015-10-21 07:41:06 -07:00
wimax net:wimax: Fix doucble word "the the" in networking.xml 2015-08-09 22:43:52 -07:00
wireless cfg80211: regulatory: restore proper user alpha2 2015-09-04 14:29:25 +02:00
x25
xfrm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2015-09-03 08:08:17 -07:00
compat.c
Kconfig lwtunnel: infrastructure for handling light weight tunnels like mpls 2015-07-21 10:39:03 -07:00
Makefile
socket.c
sysctl_net.c