4 files changed, 30 insertions, 17 deletions

diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index bac17c59b24e..34acee662230 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -332,8 +332,10 @@ struct tcp_sock {
 
         struct tcp_sack_block_wire recv_sack_cache[4];
 
-        u32     highest_sack;   /* Start seq of globally highest revd SACK
-                                 * (validity guaranteed only if sacked_out > 0) */
+        struct sk_buff *highest_sack;   /* highest skb with SACK received
+                                         * (validity guaranteed only if
+                                         * sacked_out > 0)
+                                         */
 
         /* from STCP, retrans queue hinting */
         struct sk_buff* lost_skb_hint;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index d893b4480769..0ede804b16d4 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1312,6 +1312,16 @@ static inline int tcp_write_queue_empty(struct sock *sk)
         return skb_queue_empty(&sk->sk_write_queue);
 }
 
+/* Start sequence of the highest skb with SACKed bit, valid only if
+ * sacked > 0 or when the caller has ensured validity by itself.
+ */
+static inline u32 tcp_highest_sack_seq(struct tcp_sock *tp)
+{
+        if (!tp->sacked_out)
+                return tp->snd_una;
+        return TCP_SKB_CB(tp->highest_sack)->seq;
+}
+
 /* /proc */
 enum tcp_seq_states {
         TCP_SEQ_STATE_LISTENING,
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c0e8f2b1fa7e..31294b52ad42 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1245,7 +1245,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
         int num_sacks = (ptr[1] - TCPOLEN_SACK_BASE)>>3;
         int reord = tp->packets_out;
         int prior_fackets;
-        u32 highest_sack_end_seq = tp->lost_retrans_low;
+        u32 highest_sack_end_seq;
         int flag = 0;
         int found_dup_sack = 0;
         int cached_fack_count;
@@ -1256,7 +1256,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
         if (!tp->sacked_out) {
                 if (WARN_ON(tp->fackets_out))
                         tp->fackets_out = 0;
-                tp->highest_sack = tp->snd_una;
+                tp->highest_sack = tcp_write_queue_head(sk);
         }
         prior_fackets = tp->fackets_out;
 
@@ -1483,10 +1483,9 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                                 if (fack_count > tp->fackets_out)
                                         tp->fackets_out = fack_count;
 
-                                if (after(TCP_SKB_CB(skb)->seq, tp->highest_sack)) {
-                                        tp->highest_sack = TCP_SKB_CB(skb)->seq;
-                                        highest_sack_end_seq = TCP_SKB_CB(skb)->end_seq;
-                                }
+                                if (after(TCP_SKB_CB(skb)->seq, tcp_highest_sack_seq(tp)))
+                                        tp->highest_sack = skb;
+
                         } else {
                                 if (dup_sack && (sacked&TCPCB_RETRANS))
                                         reord = min(fack_count, reord);
@@ -1514,6 +1513,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                         flag &= ~FLAG_ONLY_ORIG_SACKED;
         }
 
+        highest_sack_end_seq = TCP_SKB_CB(tp->highest_sack)->end_seq;
         if (tcp_is_fack(tp) && tp->retrans_out &&
             after(highest_sack_end_seq, tp->lost_retrans_low) &&
             icsk->icsk_ca_state == TCP_CA_Recovery)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index f4c1eef89af0..ce506af5ce07 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -657,13 +657,15 @@ static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned
  * tweak SACK fastpath hint too as it would overwrite all changes unless
  * hint is also changed.
  */
-static void tcp_adjust_fackets_out(struct tcp_sock *tp, struct sk_buff *skb,
+static void tcp_adjust_fackets_out(struct sock *sk, struct sk_buff *skb,
                                    int decr)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
+
         if (!tp->sacked_out || tcp_is_reno(tp))
                 return;
 
-        if (!before(tp->highest_sack, TCP_SKB_CB(skb)->seq))
+        if (!before(tcp_highest_sack_seq(tp), TCP_SKB_CB(skb)->seq))
                 tp->fackets_out -= decr;
 
         /* cnt_hint is "off-by-one" compared with fackets_out (see sacktag) */
@@ -712,9 +714,8 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         TCP_SKB_CB(buff)->end_seq = TCP_SKB_CB(skb)->end_seq;
         TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(buff)->seq;
 
-        if (tcp_is_sack(tp) && tp->sacked_out &&
-            (TCP_SKB_CB(skb)->seq == tp->highest_sack))
-                tp->highest_sack = TCP_SKB_CB(buff)->seq;
+        if (tcp_is_sack(tp) && tp->sacked_out && (skb == tp->highest_sack))
+                tp->highest_sack = buff;
 
         /* PSH and FIN should only be set in the second packet. */
         flags = TCP_SKB_CB(skb)->flags;
@@ -772,7 +773,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
                         tcp_dec_pcount_approx_int(&tp->sacked_out, diff);
                         tcp_verify_left_out(tp);
                 }
-                tcp_adjust_fackets_out(tp, skb, diff);
+                tcp_adjust_fackets_out(sk, skb, diff);
         }
 
         /* Link BUFF into the send queue. */
@@ -1712,7 +1713,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *skb, int m
                        tcp_skb_pcount(next_skb) != 1);
 
                 if (WARN_ON(tcp_is_sack(tp) && tp->sacked_out &&
-                    (TCP_SKB_CB(next_skb)->seq == tp->highest_sack)))
+                    (next_skb == tp->highest_sack)))
                         return;
 
                 /* Ok.  We will be able to collapse the packet. */
@@ -1747,7 +1748,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *skb, int m
                 if (tcp_is_reno(tp) && tp->sacked_out)
                         tcp_dec_pcount_approx(&tp->sacked_out, next_skb);
 
-                tcp_adjust_fackets_out(tp, next_skb, tcp_skb_pcount(next_skb));
+                tcp_adjust_fackets_out(sk, next_skb, tcp_skb_pcount(next_skb));
                 tp->packets_out -= tcp_skb_pcount(next_skb);
 
                 /* changed transmit queue under us so clear hints */
@@ -2028,7 +2029,7 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
                         break;
                 tp->forward_skb_hint = skb;
 
-                if (after(TCP_SKB_CB(skb)->seq, tp->highest_sack))
+                if (after(TCP_SKB_CB(skb)->seq, tcp_highest_sack_seq(tp)))
                         break;
 
                 if (tcp_packets_in_flight(tp) >= tp->snd_cwnd)