From: Jon Maloy <jon.ma...@ericsson.com> Date: Sat, 7 Oct 2017 15:07:20 +0200
> When a bundling message is received, the function tipc_link_input() > calls function tipc_msg_extract() to unbundle all inner messages of > the bundling message before adding them to input queue. > > The function tipc_msg_extract() just clones all inner skb for all > inner messagges from the bundling skb. This means that the skb > headroom of an inner message overlaps with the data part of the > preceding message in the bundle. > > If the message in question is a name addressed message, it may be > subject to a secondary destination lookup, and eventually be sent out > on one of the interfaces again. But, since what is perceived as headroom > by the device driver in reality is the last bytes of the preceding > message in the bundle, the latter will be overwritten by the MAC > addresses of the L2 header. If the preceding message has not yet been > consumed by the user, it will evenually be delivered with corrupted > contents. > > This commit fixes this by uncloning all messages passing through the > function tipc_msg_lookup_dest(), hence ensuring that the headroom > is always valid when the message is passed on. > > Signed-off-by: Tung Nguyen <tung.q.ngu...@dektech.com.au> > Signed-off-by: Jon Maloy <jon.ma...@ericsson.com> Applied.
