Jon Paul Maloy 6000843594 tipc: clear 'next'-pointer of message fragments before reassembly ... [ Upstream commit 999417549c16dd0e3a382aa9f6ae61688db03181 ] If the 'next' pointer of the last fragment buffer in a message is not zeroed before reassembly, we risk ending up with a corrupt message, since the reassembly function itself isn't doing this. Currently, when a buffer is retrieved from the deferred queue of the broadcast link, the next pointer is not cleared, with the result as described above. This commit corrects this, and thereby fixes a bug that may occur when long broadcast messages are transmitted across dual interfaces. The bug has been present since 40ba3cdf542a469aaa9083fa041656e59b109b90 ("tipc: message reassembly using fragment chain") This commit should be applied to both net and net-next. Signed-off-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-07-28 08:00:05 -07:00
..
addr.c
addr.h
bcast.c
bcast.h
bearer.c
bearer.h
config.c
config.h
core.c
core.h
discover.c
discover.h
eth_media.c
handler.c
ib_media.c
Kconfig
link.c
link.h
log.c
Makefile
msg.c
msg.h
name_distr.c
name_distr.h
name_table.c
name_table.h
net.c
net.h
netlink.c
node.c
node.h
node_subscr.c
node_subscr.h
port.c
port.h
ref.c
ref.h
socket.c
subscr.c
subscr.h