+/**
+ * link_recv_buf_validate - validate basic format of received message
+ *
+ * This routine ensures a TIPC message has an acceptable header, and at least
+ * as much data as the header indicates it should. The routine also ensures
+ * that the entire message header is stored in the main fragment of the message
+ * buffer, to simplify future access to message header fields.
+ *
+ * Note: Having extra info present in the message header or data areas is OK.
+ * TIPC will ignore the excess, under the assumption that it is optional info
+ * introduced by a later release of the protocol.
+ */
+
+static int link_recv_buf_validate(struct sk_buff *buf)
+{
+ static u32 min_data_hdr_size[8] = {
+ SHORT_H_SIZE, MCAST_H_SIZE, LONG_H_SIZE, DIR_MSG_H_SIZE,
+ MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE
+ };
+
+ struct tipc_msg *msg;
+ u32 tipc_hdr[2];
+ u32 size;
+ u32 hdr_size;
+ u32 min_hdr_size;
+
+ if (unlikely(buf->len < MIN_H_SIZE))
+ return 0;
+
+ msg = skb_header_pointer(buf, 0, sizeof(tipc_hdr), tipc_hdr);
+ if (msg == NULL)
+ return 0;
+
+ if (unlikely(msg_version(msg) != TIPC_VERSION))
+ return 0;
+
+ size = msg_size(msg);
+ hdr_size = msg_hdr_sz(msg);
+ min_hdr_size = msg_isdata(msg) ?
+ min_data_hdr_size[msg_type(msg)] : INT_H_SIZE;
+
+ if (unlikely((hdr_size < min_hdr_size) ||
+ (size < hdr_size) ||
+ (buf->len < size) ||
+ (size - hdr_size > TIPC_MAX_USER_MSG_SIZE)))
+ return 0;
+
+ return pskb_may_pull(buf, hdr_size);
+}
+