1 files changed, 19 insertions, 4 deletions

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index c10e4435e3b1..c5b911f9b662 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -190,7 +190,7 @@ void tcp_select_initial_window(int __space, __u32 mss,
         }
 
         /* Set initial window to value enough for senders,
-         * following RFC1414. Senders, not following this RFC,
+         * following RFC2414. Senders, not following this RFC,
          * will be satisfied with 2.
          */
         if (mss > (1<<*rcv_wscale)) {
@@ -435,6 +435,8 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         int nsize, old_factor;
         u16 flags;
 
+        BUG_ON(len >= skb->len);
+
         nsize = skb_headlen(skb) - len;
         if (nsize < 0)
                 nsize = 0;
@@ -459,9 +461,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         flags = TCP_SKB_CB(skb)->flags;
         TCP_SKB_CB(skb)->flags = flags & ~(TCPCB_FLAG_FIN|TCPCB_FLAG_PSH);
         TCP_SKB_CB(buff)->flags = flags;
-        TCP_SKB_CB(buff)->sacked =
-                (TCP_SKB_CB(skb)->sacked &
-                 (TCPCB_LOST | TCPCB_EVER_RETRANS | TCPCB_AT_TAIL));
+        TCP_SKB_CB(buff)->sacked = TCP_SKB_CB(skb)->sacked;
         TCP_SKB_CB(skb)->sacked &= ~TCPCB_AT_TAIL;
 
         if (!skb_shinfo(skb)->nr_frags && skb->ip_summed != CHECKSUM_HW) {
@@ -499,11 +499,26 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
                         tcp_skb_pcount(buff);
 
                 tp->packets_out -= diff;
+
+                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
+                        tp->sacked_out -= diff;
+                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
+                        tp->retrans_out -= diff;
+
                 if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST) {
                         tp->lost_out -= diff;
                         tp->left_out -= diff;
                 }
+
                 if (diff > 0) {
+                        /* Adjust Reno SACK estimate. */
+                        if (!tp->rx_opt.sack_ok) {
+                                tp->sacked_out -= diff;
+                                if ((int)tp->sacked_out < 0)
+                                        tp->sacked_out = 0;
+                                tcp_sync_left_out(tp);
+                        }
+
                         tp->fackets_out -= diff;
                         if ((int)tp->fackets_out < 0)
                                 tp->fackets_out = 0;