When doing TSO subtract hdrlen from TCP_MAXWIN to prevent ip->ip_len

from wrapping when we generate a maximally sized packet for later
segmentation.

Noticed by:	gallatin
Sponsored by:	TCP/IP Optimization Fundraise 2005

1 files changed, 7 insertions, 5 deletions

diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
index 986f956..dc67a5d 100644
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -730,16 +730,18 @@ send:
 	 * Clear the FIN bit because we cut off the tail of
 	 * the segment.
 	 *
-	 * When doing TSO limit a burst to TCP_MAXWIN and set the
-	 * flag to continue sending and prevent the last segment
-	 * from being fractional thus making them all equal sized.
+	 * When doing TSO limit a burst to TCP_MAXWIN minus the
+	 * IP, TCP and Options length to keep ip->ip_len from
+	 * overflowing.  Prevent the last segment from being
+	 * fractional thus making them all equal sized and set
+	 * the flag to continue sending.
 	 */
 	if (len + optlen + ipoptlen > tp->t_maxopd) {
 		flags &= ~TH_FIN;
 		if (tso) {
 			if (len > TCP_MAXWIN) {
-				len = TCP_MAXWIN - TCP_MAXWIN %
-					(tp->t_maxopd - optlen);
+				len = TCP_MAXWIN - hdrlen;
+				len = len - (len % (tp->t_maxopd - optlen));
 				sendalot = 1;
 			} else if (tp->t_flags & TF_NEEDFIN)
 				sendalot = 1;