diff --git a/[refs] b/[refs]
index 01c154b627eb..9acf3d78cf58 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: a7a41acf99d9150b424839b0d7b4f5ad9d211e2d
+refs/heads/master: 9fa5fdf291c9b58b1cb8b4bb2a0ee57efa21d635
diff --git a/trunk/net/ipv4/tcp.c b/trunk/net/ipv4/tcp.c
index 0cd71b84e483..76b148bcb0dc 100644
--- a/trunk/net/ipv4/tcp.c
+++ b/trunk/net/ipv4/tcp.c
@@ -524,7 +524,8 @@ static int tcp_splice_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
 	struct tcp_splice_state *tss = rd_desc->arg.data;
 	int ret;
 
-	ret = skb_splice_bits(skb, offset, tss->pipe, rd_desc->count, tss->flags);
+	ret = skb_splice_bits(skb, offset, tss->pipe, min(rd_desc->count, len),
+			      tss->flags);
 	if (ret > 0)
 		rd_desc->count -= ret;
 	return ret;