From d901d282cffdd67cc44282ed1f6c8e093a0f1d92 Mon Sep 17 00:00:00 2001
From: Allan Stephens <allan.stephens@windriver.com>
Date: Mon, 3 Jul 2006 19:39:36 -0700
Subject: [PATCH] --- yaml --- r: 31951 b: refs/heads/master c:
 863fae666acb87b150f4634e6e79476ebe274f43 h: refs/heads/master i:   31949:
 7358b1ec4e1dea914465691e6b81808811379671   31947:
 4139a1ce83af9cc90c9cbdb96dfeeb3b5cfa008a   31943:
 07bb563327094b799d6e22e1bca6deb51d99c5e1   31935:
 6e96dade448e4f1dd070bc04faafc83c2912082f v: v3

---
 [refs]                | 2 +-
 trunk/net/tipc/core.h | 5 ++++-
 trunk/net/tipc/link.c | 2 ++
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index ca8ed79b7da6..8942a0292486 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: bbcf467dab42ea3c85f368df346c82af2fbba665
+refs/heads/master: 863fae666acb87b150f4634e6e79476ebe274f43
diff --git a/trunk/net/tipc/core.h b/trunk/net/tipc/core.h
index 86f54f3512f1..762aac2572be 100644
--- a/trunk/net/tipc/core.h
+++ b/trunk/net/tipc/core.h
@@ -297,7 +297,10 @@ static inline struct tipc_msg *buf_msg(struct sk_buff *skb)
  * buf_acquire - creates a TIPC message buffer
  * @size: message size (including TIPC header)
  *
- * Returns a new buffer.  Space is reserved for a data link header.
+ * Returns a new buffer with data pointers set to the specified size.
+ * 
+ * NOTE: Headroom is reserved to allow prepending of a data link header.
+ *       There may also be unrequested tailroom present at the buffer's end.
  */
 
 static inline struct sk_buff *buf_acquire(u32 size)
diff --git a/trunk/net/tipc/link.c b/trunk/net/tipc/link.c
index c6831c75cfa4..c10e18a49b96 100644
--- a/trunk/net/tipc/link.c
+++ b/trunk/net/tipc/link.c
@@ -998,6 +998,8 @@ static int link_bundle_buf(struct link *l_ptr,
 		return 0;
 	if (skb_tailroom(bundler) < (pad + size))
 		return 0;
+	if (link_max_pkt(l_ptr) < (to_pos + size))
+		return 0;
 
 	skb_put(bundler, pad + size);
 	memcpy(bundler->data + to_pos, buf->data, size);