3 files changed, 18 insertions, 5 deletions

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 33370271b8b2..70a3f8d49118 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -481,6 +481,7 @@ struct sk_buff {
         union {
                 __u32           mark;
                 __u32           dropcount;
+                __u32           avail_size;
         };
 
         sk_buff_data_t          transport_header;
@@ -1366,6 +1367,18 @@ static inline int skb_tailroom(const struct sk_buff *skb)
 }
 
 /**
+ *      skb_availroom - bytes at buffer end
+ *      @skb: buffer to check
+ *
+ *      Return the number of bytes of free space at the tail of an sk_buff
+ *      allocated by sk_stream_alloc()
+ */
+static inline int skb_availroom(const struct sk_buff *skb)
+{
+        return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len;
+}
+
+/**
  *      skb_reserve - adjust headroom
  *      @skb: buffer to alter
  *      @len: bytes to move
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 7758a83f98ff..a5daa211a8e1 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -701,11 +701,12 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
         skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp);
         if (skb) {
                 if (sk_wmem_schedule(sk, skb->truesize)) {
+                        skb_reserve(skb, sk->sk_prot->max_header);
                         /*
                          * Make sure that we have exactly size bytes
                          * available to the caller, no more, no less.
                          */
-                        skb_reserve(skb, skb_tailroom(skb) - size);
+                        skb->avail_size = size;
                         return skb;
                 }
                 __kfree_skb(skb);
@@ -995,10 +996,9 @@ new_segment:
                                 copy = seglen;
 
                         /* Where to copy to? */
-                        if (skb_tailroom(skb) > 0) {
+                        if (skb_availroom(skb) > 0) {
                                 /* We have some space in skb head. Superb! */
-                                if (copy > skb_tailroom(skb))
-                                        copy = skb_tailroom(skb);
+                                copy = min_t(int, copy, skb_availroom(skb));
                                 err = skb_add_data_nocache(sk, skb, from, copy);
                                 if (err)
                                         goto do_fault;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 364784a91939..376b2cfbb685 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2060,7 +2060,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
                 /* Punt if not enough space exists in the first SKB for
                  * the data in the second
                  */
-                if (skb->len > skb_tailroom(to))
+                if (skb->len > skb_availroom(to))
                         break;
 
                 if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))