1 files changed, 30 insertions, 23 deletions

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7d076f0db100..566045e58437 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -861,7 +861,8 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
         u16 flags;
 
         /* All of a TSO frame must be composed of paged data.  */
-        BUG_ON(skb->len != skb->data_len);
+        if (skb->len != skb->data_len)
+                return tcp_fragment(sk, skb, len, mss_now);
 
         buff = sk_stream_alloc_pskb(sk, 0, 0, GFP_ATOMIC);
         if (unlikely(buff == NULL))
@@ -974,6 +975,8 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
 
         sent_pkts = 0;
         while ((skb = sk->sk_send_head)) {
+                unsigned int limit;
+
                 tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
                 BUG_ON(!tso_segs);
 
@@ -994,9 +997,10 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
                                 break;
                 }
 
+                limit = mss_now;
                 if (tso_segs > 1) {
-                        u32 limit = tcp_window_allows(tp, skb,
-                                                      mss_now, cwnd_quota);
+                        limit = tcp_window_allows(tp, skb,
+                                                  mss_now, cwnd_quota);
 
                         if (skb->len < limit) {
                                 unsigned int trim = skb->len % mss_now;
@@ -1004,15 +1008,12 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
                                 if (trim)
                                         limit = skb->len - trim;
                         }
-                        if (skb->len > limit) {
-                                if (tso_fragment(sk, skb, limit, mss_now))
-                                        break;
-                        }
-                } else if (unlikely(skb->len > mss_now)) {
-                        if (unlikely(tcp_fragment(sk, skb,  mss_now, mss_now)))
-                                break;
                 }
 
+                if (skb->len > limit &&
+                    unlikely(tso_fragment(sk, skb, limit, mss_now)))
+                        break;
+
                 TCP_SKB_CB(skb)->when = tcp_time_stamp;
 
                 if (unlikely(tcp_transmit_skb(sk, skb_clone(skb, GFP_ATOMIC))))
@@ -1064,11 +1065,14 @@ void tcp_push_one(struct sock *sk, unsigned int mss_now)
         cwnd_quota = tcp_snd_test(sk, skb, mss_now, TCP_NAGLE_PUSH);
 
         if (likely(cwnd_quota)) {
+                unsigned int limit;
+
                 BUG_ON(!tso_segs);
 
+                limit = mss_now;
                 if (tso_segs > 1) {
-                        u32 limit = tcp_window_allows(tp, skb,
-                                                      mss_now, cwnd_quota);
+                        limit = tcp_window_allows(tp, skb,
+                                                  mss_now, cwnd_quota);
 
                         if (skb->len < limit) {
                                 unsigned int trim = skb->len % mss_now;
@@ -1076,15 +1080,12 @@ void tcp_push_one(struct sock *sk, unsigned int mss_now)
                                 if (trim)
                                         limit = skb->len - trim;
                         }
-                        if (skb->len > limit) {
-                                if (unlikely(tso_fragment(sk, skb, limit, mss_now)))
-                                        return;
-                        }
-                } else if (unlikely(skb->len > mss_now)) {
-                        if (unlikely(tcp_fragment(sk, skb, mss_now, mss_now)))
-                                return;
                 }
 
+                if (skb->len > limit &&
+                    unlikely(tso_fragment(sk, skb, limit, mss_now)))
+                        return;
+
                 /* Send it out now. */
                 TCP_SKB_CB(skb)->when = tcp_time_stamp;
 
@@ -1370,15 +1371,21 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
 
         if (skb->len > cur_mss) {
                 int old_factor = tcp_skb_pcount(skb);
-                int new_factor;
+                int diff;
 
                 if (tcp_fragment(sk, skb, cur_mss, cur_mss))
                         return -ENOMEM; /* We'll try again later. */
 
                 /* New SKB created, account for it. */
-                new_factor = tcp_skb_pcount(skb);
-                tp->packets_out -= old_factor - new_factor;
-                tp->packets_out += tcp_skb_pcount(skb->next);
+                diff = old_factor - tcp_skb_pcount(skb) -
+                       tcp_skb_pcount(skb->next);
+                tp->packets_out -= diff;
+
+                if (diff > 0) {
+                        tp->fackets_out -= diff;
+                        if ((int)tp->fackets_out < 0)
+                                tp->fackets_out = 0;
+                }
         }
 
         /* Collapse two adjacent packets if worthwhile and we can. */