1 files changed, 41 insertions, 26 deletions

diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 08b4cc7d496d..4339aab93034 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -463,43 +463,58 @@ bool tipc_msg_make_bundle(struct sk_buff **skb,  struct tipc_msg *msg,
 
 /**
  * tipc_msg_reverse(): swap source and destination addresses and add error code
- * @buf:  buffer containing message to be reversed
- * @dnode: return value: node where to send message after reversal
- * @err:  error code to be set in message
- * Consumes buffer if failure
+ * @own_node: originating node id for reversed message
+ * @skb:  buffer containing message to be reversed; may be replaced.
+ * @err:  error code to be set in message, if any
+ * Consumes buffer at failure
  * Returns true if success, otherwise false
  */
-bool tipc_msg_reverse(u32 own_addr,  struct sk_buff *buf, u32 *dnode,
-                      int err)
+bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, u32 *dnode, int err)
 {
-        struct tipc_msg *msg = buf_msg(buf);
+        struct sk_buff *_skb = *skb;
+        struct tipc_msg *hdr = buf_msg(_skb);
         struct tipc_msg ohdr;
-        uint rdsz = min_t(uint, msg_data_sz(msg), MAX_FORWARD_SIZE);
+        int dlen = min_t(uint, msg_data_sz(hdr), MAX_FORWARD_SIZE);
 
-        if (skb_linearize(buf))
+        if (skb_linearize(_skb))
                 goto exit;
-        msg = buf_msg(buf);
-        if (msg_dest_droppable(msg))
+        hdr = buf_msg(_skb);
+        if (msg_dest_droppable(hdr))
                 goto exit;
-        if (msg_errcode(msg))
+        if (msg_errcode(hdr))
                 goto exit;
-        memcpy(&ohdr, msg, msg_hdr_sz(msg));
-        msg_set_errcode(msg, err);
-        msg_set_origport(msg, msg_destport(&ohdr));
-        msg_set_destport(msg, msg_origport(&ohdr));
-        msg_set_prevnode(msg, own_addr);
-        if (!msg_short(msg)) {
-                msg_set_orignode(msg, msg_destnode(&ohdr));
-                msg_set_destnode(msg, msg_orignode(&ohdr));
+
+        /* Take a copy of original header before altering message */
+        memcpy(&ohdr, hdr, msg_hdr_sz(hdr));
+
+        /* Never return SHORT header; expand by replacing buffer if necessary */
+        if (msg_short(hdr)) {
+                *skb = tipc_buf_acquire(BASIC_H_SIZE + dlen);
+                if (!*skb)
+                        goto exit;
+                memcpy((*skb)->data + BASIC_H_SIZE, msg_data(hdr), dlen);
+                kfree_skb(_skb);
+                _skb = *skb;
+                hdr = buf_msg(_skb);
+                memcpy(hdr, &ohdr, BASIC_H_SIZE);
+                msg_set_hdr_sz(hdr, BASIC_H_SIZE);
         }
-        msg_set_size(msg, msg_hdr_sz(msg) + rdsz);
-        skb_trim(buf, msg_size(msg));
-        skb_orphan(buf);
-        *dnode = msg_orignode(&ohdr);
+
+        /* Now reverse the concerned fields */
+        msg_set_errcode(hdr, err);
+        msg_set_origport(hdr, msg_destport(&ohdr));
+        msg_set_destport(hdr, msg_origport(&ohdr));
+        msg_set_destnode(hdr, msg_prevnode(&ohdr));
+        msg_set_prevnode(hdr, own_node);
+        msg_set_orignode(hdr, own_node);
+        msg_set_size(hdr, msg_hdr_sz(hdr) + dlen);
+        *dnode = msg_destnode(hdr);
+        skb_trim(_skb, msg_size(hdr));
+        skb_orphan(_skb);
         return true;
 exit:
-        kfree_skb(buf);
-        *dnode = 0;
+        kfree_skb(_skb);
+        *skb = NULL;
         return false;
 }