1 files changed, 8 insertions, 4 deletions

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index dda42f0bd7a3..f5263c840338 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -663,10 +663,14 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         th->urg_ptr             = 0;
 
         /* The urg_mode check is necessary during a below snd_una win probe */
-        if (unlikely(tcp_urg_mode(tp) &&
-                     between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF))) {
-                th->urg_ptr             = htons(tp->snd_up - tcb->seq);
-                th->urg                 = 1;
+        if (unlikely(tcp_urg_mode(tp) && before(tcb->seq, tp->snd_up))) {
+                if (before(tp->snd_up, tcb->seq + 0x10000)) {
+                        th->urg_ptr = htons(tp->snd_up - tcb->seq);
+                        th->urg = 1;
+                } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
+                        th->urg_ptr = 0xFFFF;
+                        th->urg = 1;
+                }
         }
 
         tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);