1. 30 8月, 2014 1 次提交
  2. 24 8月, 2014 15 次提交
  3. 20 8月, 2014 1 次提交
  4. 17 8月, 2014 1 次提交
  5. 30 7月, 2014 1 次提交
  6. 29 7月, 2014 1 次提交
    • J
      tipc: make tipc_buf_append() more robust · 13e9b997
      Jon Paul Maloy 提交于
      As per comment from David Miller, we try to make the buffer reassembly
      function more resilient to user errors than it is today.
      
      - We check that the "*buf" parameter always is set, since this is
        mandatory input.
      
      - We ensure that *buf->next always is set to NULL before linking in
        the buffer, instead of relying of the caller to have done this.
      
      - We ensure that the "tail" pointer in the head buffer's control
        block is initialized to NULL when the first fragment arrives.
      Signed-off-by: NJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      13e9b997
  7. 21 7月, 2014 1 次提交
  8. 17 7月, 2014 7 次提交
  9. 16 7月, 2014 1 次提交
  10. 12 7月, 2014 1 次提交
    • J
      tipc: clear 'next'-pointer of message fragments before reassembly · 99941754
      Jon Paul Maloy 提交于
      If the 'next' pointer of the last fragment buffer in a message is not
      zeroed before reassembly, we risk ending up with a corrupt message,
      since the reassembly function itself isn't doing this.
      
      Currently, when a buffer is retrieved from the deferred queue of the
      broadcast link, the next pointer is not cleared, with the result as
      described above.
      
      This commit corrects this, and thereby fixes a bug that may occur when
      long broadcast messages are transmitted across dual interfaces. The bug
      has been present since 40ba3cdf ("tipc:
      message reassembly using fragment chain")
      
      This commit should be applied to both net and net-next.
      Signed-off-by: NJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      99941754
  11. 09 7月, 2014 2 次提交
  12. 08 7月, 2014 2 次提交
  13. 28 6月, 2014 6 次提交