1 files changed, 9 insertions, 8 deletions

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2d656eef7f8e..1c2a73406261 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2164,8 +2164,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
-        int cnt, oldcnt;
-        int err;
+        int cnt, oldcnt, lost;
         unsigned int mss;
         /* Use SACK to deduce losses of new sequences sent during recovery */
         const u32 loss_high = tcp_is_sack(tp) ?  tp->snd_nxt : tp->high_seq;
@@ -2205,9 +2204,10 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                                 break;
 
                         mss = tcp_skb_mss(skb);
-                        err = tcp_fragment(sk, skb, (packets - oldcnt) * mss,
-                                           mss, GFP_ATOMIC);
-                        if (err < 0)
+                        /* If needed, chop off the prefix to mark as lost. */
+                        lost = (packets - oldcnt) * mss;
+                        if (lost < skb->len &&
+                            tcp_fragment(sk, skb, lost, mss, GFP_ATOMIC) < 0)
                                 break;
                         cnt = packets;
                 }
@@ -2366,8 +2366,6 @@ static void tcp_undo_cwnd_reduction(struct sock *sk, bool unmark_loss)
                         tp->snd_ssthresh = tp->prior_ssthresh;
                         tcp_ecn_withdraw_cwr(tp);
                 }
-        } else {
-                tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh);
         }
         tp->snd_cwnd_stamp = tcp_time_stamp;
         tp->undo_marker = 0;
@@ -2478,6 +2476,9 @@ static void tcp_cwnd_reduction(struct sock *sk, const int prior_unsacked,
         int newly_acked_sacked = prior_unsacked -
                                  (tp->packets_out - tp->sacked_out);
 
+        if (newly_acked_sacked <= 0 || WARN_ON_ONCE(!tp->prior_cwnd))
+                return;
+
         tp->prr_delivered += newly_acked_sacked;
         if (delta < 0) {
                 u64 dividend = (u64)tp->snd_ssthresh * tp->prr_delivered +
@@ -6204,7 +6205,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
         tcp_openreq_init(req, &tmp_opt, skb, sk);
 
         /* Note: tcp_v6_init_req() might override ir_iif for link locals */
-        inet_rsk(req)->ir_iif = sk->sk_bound_dev_if;
+        inet_rsk(req)->ir_iif = inet_request_bound_dev_if(sk, skb);
 
         af_ops->init_req(req, sk, skb);