Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/net-2.6: (41 commits)
  [XFRM]: Fix leak of expired xfrm_states
  [ATM]: [he] initialize lock and tasklet earlier
  [IPV4]: Remove bogus ifdef mess in arp_process
  [SKBUFF]: Free old skb properly in skb_morph
  [IPV4]: Fix memory leak in inet_hashtables.h when NUMA is on
  [IPSEC]: Temporarily remove locks around copying of non-atomic fields
  [TCP] MTUprobe: Cleanup send queue check (no need to loop)
  [TCP]: MTUprobe: receiver window & data available checks fixed
  [MAINTAINERS]: tlan list is subscribers-only
  [SUNRPC]: Remove SPIN_LOCK_UNLOCKED
  [SUNRPC]: Make xprtsock.c:xs_setup_{udp,tcp}() static
  [PFKEY]: Sending an SADB_GET responds with an SADB_GET
  [IRDA]: Compilation for CONFIG_INET=n case
  [IPVS]: Fix compiler warning about unused register_ip_vs_protocol
  [ARP]: Fix arp reply when sender ip 0
  [IPV6] TCPMD5: Fix deleting key operation.
  [IPV6] TCPMD5: Check return value of tcp_alloc_md5sig_pool().
  [IPV4] TCPMD5: Use memmove() instead of memcpy() because we have overlaps.
  [IPV4] TCPMD5: Omit redundant NULL check for kfree() argument.
  ieee80211: Stop net_ratelimit/IEEE80211_DEBUG_DROP log pollution
  ...

1 files changed, 7 insertions, 14 deletions

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 324b4207254a..e5130a7fe181 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1295,6 +1295,7 @@ static int tcp_mtu_probe(struct sock *sk)
         struct sk_buff *skb, *nskb, *next;
         int len;
         int probe_size;
+        int size_needed;
         unsigned int pif;
         int copy;
         int mss_now;
@@ -1313,27 +1314,20 @@ static int tcp_mtu_probe(struct sock *sk)
         /* Very simple search strategy: just double the MSS. */
         mss_now = tcp_current_mss(sk, 0);
         probe_size = 2*tp->mss_cache;
+        size_needed = probe_size + (tp->reordering + 1) * tp->mss_cache;
         if (probe_size > tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_high)) {
                 /* TODO: set timer for probe_converge_event */
                 return -1;
         }
 
         /* Have enough data in the send queue to probe? */
-        len = 0;
-        if ((skb = tcp_send_head(sk)) == NULL)
-                return -1;
-        while ((len += skb->len) < probe_size && !tcp_skb_is_last(sk, skb))
-                skb = tcp_write_queue_next(sk, skb);
-        if (len < probe_size)
+        if (tp->write_seq - tp->snd_nxt < size_needed)
                 return -1;
 
-        /* Receive window check. */
-        if (after(TCP_SKB_CB(skb)->seq + probe_size, tp->snd_una + tp->snd_wnd)) {
-                if (tp->snd_wnd < probe_size)
-                        return -1;
-                else
-                        return 0;
-        }
+        if (tp->snd_wnd < size_needed)
+                return -1;
+        if (after(tp->snd_nxt + size_needed, tp->snd_una + tp->snd_wnd))
+                return 0;
 
         /* Do we need to wait to drain cwnd? */
         pif = tcp_packets_in_flight(tp);
@@ -1352,7 +1346,6 @@ static int tcp_mtu_probe(struct sock *sk)
 
         skb = tcp_send_head(sk);
         tcp_insert_write_queue_before(nskb, skb, sk);
-        tcp_advance_send_head(sk, skb);
 
         TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(skb)->seq;
         TCP_SKB_CB(nskb)->end_seq = TCP_SKB_CB(skb)->seq + probe_size;