Patch "tipc: allow non-linear first fragment buffer" has been added to the 4.1-stable tree

This is a note to let you know that I've just added the patch titled

tipc: allow non-linear first fragment buffer

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
tipc-allow-non-linear-first-fragment-buffer.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Jon Paul Maloy <[email protected]>
Date: Mon, 19 Oct 2015 11:33:00 -0400
Subject: tipc: allow non-linear first fragment buffer

From: Jon Paul Maloy <[email protected]>

[ Upstream commit 45c8b7b175ceb2d542e0fe15247377bf3bce29ec ]

The current code for message reassembly is erroneously assuming that the the first arriving fragment buffer always is linear, and then goes ahead resetting the fragment list of that buffer in anticipation of more arriving fragments.

However, if the buffer already happens to be non-linear, we will inadvertently drop the already attached fragment list, and later on trig a BUG() in __pskb_pull_tail().

We see this happen when running fragmented TIPC multicast across UDP, something made possible since
commit d0f91938bede ("tipc: add ip/udp media type")

We fix this by not resetting the fragment list when the buffer is non- linear, and by initiatlizing our private fragment list tail pointer to the tail of the existing fragment list.

---
 net/tipc/msg.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

@@ -121,7 +121,7 @@ int tipc_buf_append(struct sk_buff **hea
 {
 	struct sk_buff *head = *headbuf;
 	struct sk_buff *frag = *buf;
-	struct sk_buff *tail;
+	struct sk_buff *tail = NULL;
 	struct tipc_msg *msg;
 	u32 fragid;
 	int delta;

@@ -141,9 +141,15 @@ int tipc_buf_append(struct sk_buff **hea
 		if (unlikely(skb_unclone(frag, GFP_ATOMIC)))
 			goto err;
 		head = *headbuf = frag;
-		skb_frag_list_init(head);
-		TIPC_SKB_CB(head)->tail = NULL;
 		*buf = NULL;
+		TIPC_SKB_CB(head)->tail = NULL;
+		if (skb_is_nonlinear(head)) {
+			skb_walk_frags(head, tail) {
+				TIPC_SKB_CB(head)->tail = tail;
+			}
+		} else {
+			skb_frag_list_init(head);
+		}
 		return 0;
 	}
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/tipc-allow-non-linear-first-fragment-buffer.patch queue-4.1/tipc-linearize-arriving-name_distr-and-link_proto-buffers.patch