1 files changed, 21 insertions, 23 deletions

diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index ff7362d40cb3..08b4cc7d496d 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -331,16 +331,15 @@ error:
 
 /**
  * tipc_msg_bundle(): Append contents of a buffer to tail of an existing one
- * @bskb: the buffer to append to ("bundle")
- * @skb:  buffer to be appended
+ * @skb: the buffer to append to ("bundle")
+ * @msg:  message to be appended
  * @mtu:  max allowable size for the bundle buffer
  * Consumes buffer if successful
  * Returns true if bundling could be performed, otherwise false
  */
-bool tipc_msg_bundle(struct sk_buff *bskb, struct sk_buff *skb, u32 mtu)
+bool tipc_msg_bundle(struct sk_buff *skb, struct tipc_msg *msg, u32 mtu)
 {
         struct tipc_msg *bmsg;
-        struct tipc_msg *msg = buf_msg(skb);
         unsigned int bsz;
         unsigned int msz = msg_size(msg);
         u32 start, pad;
@@ -348,9 +347,9 @@ bool tipc_msg_bundle(struct sk_buff *bskb, struct sk_buff *skb, u32 mtu)
 
         if (likely(msg_user(msg) == MSG_FRAGMENTER))
                 return false;
-        if (!bskb)
+        if (!skb)
                 return false;
-        bmsg = buf_msg(bskb);
+        bmsg = buf_msg(skb);
         bsz = msg_size(bmsg);
         start = align(bsz);
         pad = start - bsz;
@@ -359,9 +358,9 @@ bool tipc_msg_bundle(struct sk_buff *bskb, struct sk_buff *skb, u32 mtu)
                 return false;
         if (unlikely(msg_user(msg) == BCAST_PROTOCOL))
                 return false;
-        if (likely(msg_user(bmsg) != MSG_BUNDLER))
+        if (unlikely(msg_user(bmsg) != MSG_BUNDLER))
                 return false;
-        if (unlikely(skb_tailroom(bskb) < (pad + msz)))
+        if (unlikely(skb_tailroom(skb) < (pad + msz)))
                 return false;
         if (unlikely(max < (start + msz)))
                 return false;
@@ -369,11 +368,10 @@ bool tipc_msg_bundle(struct sk_buff *bskb, struct sk_buff *skb, u32 mtu)
             (msg_importance(bmsg) == TIPC_SYSTEM_IMPORTANCE))
                 return false;
 
-        skb_put(bskb, pad + msz);
-        skb_copy_to_linear_data_offset(bskb, start, skb->data, msz);
+        skb_put(skb, pad + msz);
+        skb_copy_to_linear_data_offset(skb, start, msg, msz);
         msg_set_size(bmsg, start + msz);
         msg_set_msgcnt(bmsg, msg_msgcnt(bmsg) + 1);
-        kfree_skb(skb);
         return true;
 }
 
@@ -419,18 +417,18 @@ none:
 
 /**
  * tipc_msg_make_bundle(): Create bundle buf and append message to its tail
- * @list: the buffer chain
- * @skb: buffer to be appended and replaced
+ * @list: the buffer chain, where head is the buffer to replace/append
+ * @skb: buffer to be created, appended to and returned in case of success
+ * @msg: message to be appended
  * @mtu: max allowable size for the bundle buffer, inclusive header
  * @dnode: destination node for message. (Not always present in header)
- * Replaces buffer if successful
  * Returns true if success, otherwise false
  */
-bool tipc_msg_make_bundle(struct sk_buff **skb, u32 mtu, u32 dnode)
+bool tipc_msg_make_bundle(struct sk_buff **skb,  struct tipc_msg *msg,
+                          u32 mtu, u32 dnode)
 {
-        struct sk_buff *bskb;
+        struct sk_buff *_skb;
         struct tipc_msg *bmsg;
-        struct tipc_msg *msg = buf_msg(*skb);
         u32 msz = msg_size(msg);
         u32 max = mtu - INT_H_SIZE;
 
@@ -443,12 +441,12 @@ bool tipc_msg_make_bundle(struct sk_buff **skb, u32 mtu, u32 dnode)
         if (msz > (max / 2))
                 return false;
 
-        bskb = tipc_buf_acquire(max);
-        if (!bskb)
+        _skb = tipc_buf_acquire(max);
+        if (!_skb)
                 return false;
 
-        skb_trim(bskb, INT_H_SIZE);
-        bmsg = buf_msg(bskb);
+        skb_trim(_skb, INT_H_SIZE);
+        bmsg = buf_msg(_skb);
         tipc_msg_init(msg_prevnode(msg), bmsg, MSG_BUNDLER, 0,
                       INT_H_SIZE, dnode);
         if (msg_isdata(msg))
@@ -458,8 +456,8 @@ bool tipc_msg_make_bundle(struct sk_buff **skb, u32 mtu, u32 dnode)
         msg_set_seqno(bmsg, msg_seqno(msg));
         msg_set_ack(bmsg, msg_ack(msg));
         msg_set_bcast_ack(bmsg, msg_bcast_ack(msg));
-        tipc_msg_bundle(bskb, *skb, mtu);
-        *skb = bskb;
+        tipc_msg_bundle(_skb, msg, mtu);
+        *skb = _skb;
         return true;
 }