diff --git a/[refs] b/[refs]
index ef7f8c4ad863..70d0ab6e16c8 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 61c1d052a3c7d5acba3bd535aaffa5bb5d085181
+refs/heads/master: f0bc52f38b09308fca85f3aa9300a341364fe9c6
diff --git a/trunk/net/ipv4/tcp_input.c b/trunk/net/ipv4/tcp_input.c
index d67b6e9cc540..63c3ef6d4a1c 100644
--- a/trunk/net/ipv4/tcp_input.c
+++ b/trunk/net/ipv4/tcp_input.c
@@ -1575,11 +1575,10 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
 		goto out;
 	skb = tcp_write_queue_next(sk, prev);
 
-	if (!skb_can_shift(skb))
-		goto out;
-	if (skb == tcp_send_head(sk))
-		goto out;
-	if ((TCP_SKB_CB(skb)->sacked & TCPCB_TAGBITS) != TCPCB_SACKED_ACKED)
+	if (!skb_can_shift(skb) ||
+	    (skb == tcp_send_head(sk)) ||
+	    ((TCP_SKB_CB(skb)->sacked & TCPCB_TAGBITS) != TCPCB_SACKED_ACKED) ||
+	    (mss != tcp_shift_mss(skb)))
 		goto out;
 
 	len = skb->len;