|
@@ -1494,15 +1494,19 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
|
|
|
copied += used;
|
|
|
offset += used;
|
|
|
}
|
|
|
- /*
|
|
|
- * If recv_actor drops the lock (e.g. TCP splice
|
|
|
+ /* If recv_actor drops the lock (e.g. TCP splice
|
|
|
* receive) the skb pointer might be invalid when
|
|
|
* getting here: tcp_collapse might have deleted it
|
|
|
* while aggregating skbs from the socket queue.
|
|
|
*/
|
|
|
- skb = tcp_recv_skb(sk, seq-1, &offset);
|
|
|
- if (!skb || (offset+1 != skb->len))
|
|
|
+ skb = tcp_recv_skb(sk, seq - 1, &offset);
|
|
|
+ if (!skb)
|
|
|
break;
|
|
|
+ /* TCP coalescing might have appended data to the skb.
|
|
|
+ * Try to splice more frags
|
|
|
+ */
|
|
|
+ if (offset + 1 != skb->len)
|
|
|
+ continue;
|
|
|
}
|
|
|
if (tcp_hdr(skb)->fin) {
|
|
|
sk_eat_skb(sk, skb, false);
|