---

yaml
---
r: 31951
b: refs/heads/master
c: 863fae6
h: refs/heads/master
i:
  31949: 7358b1e
  31947: 4139a1c
  31943: 07bb563
  31935: 6e96dad
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: bbcf467dab42ea3c85f368df346c82af2fbba665
+refs/heads/master: 863fae666acb87b150f4634e6e79476ebe274f43

trunk/net/tipc/core.h

@@ -297,7 +297,10 @@ static inline struct tipc_msg *buf_msg(struct sk_buff *skb)
  * buf_acquire - creates a TIPC message buffer
  * @size: message size (including TIPC header)
  *
- * Returns a new buffer.  Space is reserved for a data link header.
+ * Returns a new buffer with data pointers set to the specified size.
+ * 
+ * NOTE: Headroom is reserved to allow prepending of a data link header.
+ *       There may also be unrequested tailroom present at the buffer's end.
  */
 
 static inline struct sk_buff *buf_acquire(u32 size)

trunk/net/tipc/link.c

@@ -998,6 +998,8 @@ static int link_bundle_buf(struct link *l_ptr,
 		return 0;
 	if (skb_tailroom(bundler) < (pad + size))
 		return 0;
+	if (link_max_pkt(l_ptr) < (to_pos + size))
+		return 0;
 
 	skb_put(bundler, pad + size);
 	memcpy(bundler->data + to_pos, buf->data, size);