1 files changed, 16 insertions, 8 deletions

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ce572f9dff02..0cd71b84e483 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -522,8 +522,12 @@ static int tcp_splice_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
                                 unsigned int offset, size_t len)
 {
         struct tcp_splice_state *tss = rd_desc->arg.data;
+        int ret;
 
-        return skb_splice_bits(skb, offset, tss->pipe, tss->len, tss->flags);
+        ret = skb_splice_bits(skb, offset, tss->pipe, rd_desc->count, tss->flags);
+        if (ret > 0)
+                rd_desc->count -= ret;
+        return ret;
 }
 
 static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
@@ -531,6 +535,7 @@ static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
         /* Store TCP splice context information in read_descriptor_t. */
         read_descriptor_t rd_desc = {
                 .arg.data = tss,
+                .count    = tss->len,
         };
 
         return tcp_read_sock(sk, &rd_desc, tcp_splice_data_recv);
@@ -611,11 +616,13 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
                 tss.len -= ret;
                 spliced += ret;
 
+                if (!timeo)
+                        break;
                 release_sock(sk);
                 lock_sock(sk);
 
                 if (sk->sk_err || sk->sk_state == TCP_CLOSE ||
-                    (sk->sk_shutdown & RCV_SHUTDOWN) || !timeo ||
+                    (sk->sk_shutdown & RCV_SHUTDOWN) ||
                     signal_pending(current))
                         break;
         }
@@ -2382,7 +2389,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
         unsigned int seq;
         __be32 delta;
         unsigned int oldlen;
-        unsigned int len;
+        unsigned int mss;
 
         if (!pskb_may_pull(skb, sizeof(*th)))
                 goto out;
@@ -2398,10 +2405,13 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
         oldlen = (u16)~skb->len;
         __skb_pull(skb, thlen);
 
+        mss = skb_shinfo(skb)->gso_size;
+        if (unlikely(skb->len <= mss))
+                goto out;
+
         if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
                 /* Packet is from an untrusted source, reset gso_segs. */
                 int type = skb_shinfo(skb)->gso_type;
-                int mss;
 
                 if (unlikely(type &
                              ~(SKB_GSO_TCPV4 |
@@ -2412,7 +2422,6 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
                              !(type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))))
                         goto out;
 
-                mss = skb_shinfo(skb)->gso_size;
                 skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
 
                 segs = NULL;
@@ -2423,8 +2432,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
         if (IS_ERR(segs))
                 goto out;
 
-        len = skb_shinfo(skb)->gso_size;
-        delta = htonl(oldlen + (thlen + len));
+        delta = htonl(oldlen + (thlen + mss));
 
         skb = segs;
         th = tcp_hdr(skb);
@@ -2440,7 +2448,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
                              csum_fold(csum_partial(skb_transport_header(skb),
                                                     thlen, skb->csum));
 
-                seq += len;
+                seq += mss;
                 skb = skb->next;
                 th = tcp_hdr(skb);