1 files changed, 22 insertions, 15 deletions

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 3f1bcff0b10b..d04632673a9e 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -910,14 +910,18 @@ void tcp_release_cb(struct sock *sk)
         if (flags & (1UL << TCP_TSQ_DEFERRED))
                 tcp_tsq_handler(sk);
 
-        if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED))
+        if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED)) {
                 tcp_write_timer_handler(sk);
-
-        if (flags & (1UL << TCP_DELACK_TIMER_DEFERRED))
+                __sock_put(sk);
+        }
+        if (flags & (1UL << TCP_DELACK_TIMER_DEFERRED)) {
                 tcp_delack_timer_handler(sk);
-
-        if (flags & (1UL << TCP_MTU_REDUCED_DEFERRED))
+                __sock_put(sk);
+        }
+        if (flags & (1UL << TCP_MTU_REDUCED_DEFERRED)) {
                 sk->sk_prot->mtu_reduced(sk);
+                __sock_put(sk);
+        }
 }
 EXPORT_SYMBOL(tcp_release_cb);
 
@@ -940,7 +944,7 @@ void __init tcp_tasklet_init(void)
  * We cant xmit new skbs from this context, as we might already
  * hold qdisc lock.
  */
-void tcp_wfree(struct sk_buff *skb)
+static void tcp_wfree(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
         struct tcp_sock *tp = tcp_sk(sk);
@@ -1522,21 +1526,21 @@ static void tcp_cwnd_validate(struct sock *sk)
  * when we would be allowed to send the split-due-to-Nagle skb fully.
  */
 static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
-                                        unsigned int mss_now, unsigned int cwnd)
+                                        unsigned int mss_now, unsigned int max_segs)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
-        u32 needed, window, cwnd_len;
+        u32 needed, window, max_len;
 
         window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
-        cwnd_len = mss_now * cwnd;
+        max_len = mss_now * max_segs;
 
-        if (likely(cwnd_len <= window && skb != tcp_write_queue_tail(sk)))
-                return cwnd_len;
+        if (likely(max_len <= window && skb != tcp_write_queue_tail(sk)))
+                return max_len;
 
         needed = min(skb->len, window);
 
-        if (cwnd_len <= needed)
-                return cwnd_len;
+        if (max_len <= needed)
+                return max_len;
 
         return needed - needed % mss_now;
 }
@@ -1765,7 +1769,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         limit = min(send_win, cong_win);
 
         /* If a full-sized TSO skb can be sent, do it. */
-        if (limit >= sk->sk_gso_max_size)
+        if (limit >= min_t(unsigned int, sk->sk_gso_max_size,
+                           sk->sk_gso_max_segs * tp->mss_cache))
                 goto send_now;
 
         /* Middle in queue won't get any more data, full sendable already? */
@@ -1999,7 +2004,9 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 limit = mss_now;
                 if (tso_segs > 1 && !tcp_urg_mode(tp))
                         limit = tcp_mss_split_point(sk, skb, mss_now,
-                                                    cwnd_quota);
+                                                    min_t(unsigned int,
+                                                          cwnd_quota,
+                                                          sk->sk_gso_max_segs));
 
                 if (skb->len > limit &&
                     unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))