1 files changed, 12 insertions, 7 deletions

diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 26d38b3d8760..5b47468739e7 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -565,18 +565,22 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err)
 /* tipc_msg_reassemble() - clone a buffer chain of fragments and
  *                         reassemble the clones into one message
  */
-struct sk_buff *tipc_msg_reassemble(struct sk_buff_head *list)
+bool tipc_msg_reassemble(struct sk_buff_head *list, struct sk_buff_head *rcvq)
 {
-        struct sk_buff *skb;
+        struct sk_buff *skb, *_skb;
         struct sk_buff *frag = NULL;
         struct sk_buff *head = NULL;
-        int hdr_sz;
+        int hdr_len;
 
         /* Copy header if single buffer */
         if (skb_queue_len(list) == 1) {
                 skb = skb_peek(list);
-                hdr_sz = skb_headroom(skb) + msg_hdr_sz(buf_msg(skb));
-                return __pskb_copy(skb, hdr_sz, GFP_ATOMIC);
+                hdr_len = skb_headroom(skb) + msg_hdr_sz(buf_msg(skb));
+                _skb = __pskb_copy(skb, hdr_len, GFP_ATOMIC);
+                if (!_skb)
+                        return false;
+                __skb_queue_tail(rcvq, _skb);
+                return true;
         }
 
         /* Clone all fragments and reassemble */
@@ -590,11 +594,12 @@ struct sk_buff *tipc_msg_reassemble(struct sk_buff_head *list)
                 if (!head)
                         goto error;
         }
-        return frag;
+        __skb_queue_tail(rcvq, frag);
+        return true;
 error:
         pr_warn("Failed do clone local mcast rcv buffer\n");
         kfree_skb(head);
-        return NULL;
+        return false;
 }
 
 /* tipc_skb_queue_sorted(); sort pkt into list according to sequence number