[TCP]: Fix packet counting in tcp_fragment().

Do not reference the tso_factor of SKB buff until
it is initialized.

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 96f51a3f863a464631fca41d2b624f5d50fdc8f8..eef6f4fa4d3ddcb0464624f0a31adcd1e3674196 100644 (file)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -473,10 +473,6 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
        TCP_SKB_CB(buff)->sacked =
                (TCP_SKB_CB(skb)->sacked &
                 (TCPCB_LOST | TCPCB_EVER_RETRANS | TCPCB_AT_TAIL));
-       if (TCP_SKB_CB(buff)->sacked&TCPCB_LOST) {
-               tcp_inc_pcount(&tp->lost_out, buff);
-               tcp_inc_pcount(&tp->left_out, buff);
-       }
        TCP_SKB_CB(skb)->sacked &= ~TCPCB_AT_TAIL;
 
        if (!skb_shinfo(skb)->nr_frags && skb->ip_summed != CHECKSUM_HW) {
@@ -503,6 +499,11 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
        tcp_set_skb_tso_factor(skb, tp->mss_cache_std);
        tcp_set_skb_tso_factor(buff, tp->mss_cache_std);
 
+       if (TCP_SKB_CB(buff)->sacked&TCPCB_LOST) {
+               tcp_inc_pcount(&tp->lost_out, buff);
+               tcp_inc_pcount(&tp->left_out, buff);
+       }
+
        /* Link BUFF into the send queue. */
        __skb_append(skb, buff);