diff options
| -rw-r--r-- | net/tipc/core.h | 5 | ||||
| -rw-r--r-- | net/tipc/link.c | 2 |
2 files changed, 6 insertions, 1 deletions
diff --git a/net/tipc/core.h b/net/tipc/core.h index 86f54f3512f1..762aac2572be 100644 --- a/net/tipc/core.h +++ b/net/tipc/core.h @@ -297,7 +297,10 @@ static inline struct tipc_msg *buf_msg(struct sk_buff *skb) * buf_acquire - creates a TIPC message buffer * @size: message size (including TIPC header) * - * Returns a new buffer. Space is reserved for a data link header. + * Returns a new buffer with data pointers set to the specified size. + * + * NOTE: Headroom is reserved to allow prepending of a data link header. + * There may also be unrequested tailroom present at the buffer's end. */ static inline struct sk_buff *buf_acquire(u32 size) diff --git a/net/tipc/link.c b/net/tipc/link.c index c6831c75cfa4..c10e18a49b96 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -998,6 +998,8 @@ static int link_bundle_buf(struct link *l_ptr, return 0; if (skb_tailroom(bundler) < (pad + size)) return 0; + if (link_max_pkt(l_ptr) < (to_pos + size)) + return 0; skb_put(bundler, pad + size); memcpy(bundler->data + to_pos, buf->data, size); |