diff --git a/[refs] b/[refs]
index 213a9ec7041a..36149813dbfc 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: bdc82bee43d11c093ff0378acef2a9550891cbb9
+refs/heads/master: fe13dda2d24eca2ee8a6bb8a0af88ab84d589fd6
diff --git a/trunk/net/tipc/core.h b/trunk/net/tipc/core.h
index b3c9df385bbc..325404fd4eb5 100644
--- a/trunk/net/tipc/core.h
+++ b/trunk/net/tipc/core.h
@@ -337,4 +337,16 @@ static inline void buf_discard(struct sk_buff *skb)
 	kfree_skb(skb);
 }
 
+/**
+ * buf_linearize - convert a TIPC message buffer into a single contiguous piece
+ * @skb: message buffer
+ *
+ * Returns 0 on success.
+ */
+
+static inline int buf_linearize(struct sk_buff *skb)
+{
+	return skb_linearize(skb);
+}
+
 #endif
diff --git a/trunk/net/tipc/link.c b/trunk/net/tipc/link.c
index a42f43430101..087379366d3c 100644
--- a/trunk/net/tipc/link.c
+++ b/trunk/net/tipc/link.c
@@ -1811,6 +1811,12 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *tb_ptr)
 #endif
 			msg_dbg(msg,"<REC<");
 
+		/* Ensure message data is a single contiguous unit */
+
+		if (unlikely(buf_linearize(buf))) {
+			goto cont;
+		}
+
 		if (unlikely(msg_non_seq(msg))) {
 			link_recv_non_seq(buf);
 			continue;