diff --git a/[refs] b/[refs]
index 95930d3cfae4..456349c700c4 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 5d4e039b2cb1ca4de9774344ea7b61ad7fa1b0a1
+refs/heads/master: 2df9001edc382c331f338f45d259feeaa740c418
diff --git a/trunk/net/ipv4/tcp_input.c b/trunk/net/ipv4/tcp_input.c
index ba34a23c1bfb..2bdb0da237e6 100644
--- a/trunk/net/ipv4/tcp_input.c
+++ b/trunk/net/ipv4/tcp_input.c
@@ -4481,26 +4481,20 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
 			__skb_queue_after(&tp->out_of_order_queue, skb1, skb);
 
 		/* And clean segments covered by new one as whole. */
-		if (skb1 && !skb_queue_is_last(&tp->out_of_order_queue, skb1)) {
-			struct sk_buff *n;
+		while (!skb_queue_is_last(&tp->out_of_order_queue, skb)) {
+			skb1 = skb_queue_next(&tp->out_of_order_queue, skb);
 
-			skb1 = skb_queue_next(&tp->out_of_order_queue, skb1);
-			skb_queue_walk_from_safe(&tp->out_of_order_queue,
-						 skb1, n) {
-				if (!after(end_seq, TCP_SKB_CB(skb1)->seq))
-					break;
-				if (before(end_seq,
-					   TCP_SKB_CB(skb1)->end_seq)) {
-					tcp_dsack_extend(sk,
-							 TCP_SKB_CB(skb1)->seq,
-							 end_seq);
-					break;
-				}
-				__skb_unlink(skb1, &tp->out_of_order_queue);
+			if (!after(end_seq, TCP_SKB_CB(skb1)->seq))
+				break;
+			if (before(end_seq, TCP_SKB_CB(skb1)->end_seq)) {
 				tcp_dsack_extend(sk, TCP_SKB_CB(skb1)->seq,
-						 TCP_SKB_CB(skb1)->end_seq);
-				__kfree_skb(skb1);
+						 end_seq);
+				break;
 			}
+			__skb_unlink(skb1, &tp->out_of_order_queue);
+			tcp_dsack_extend(sk, TCP_SKB_CB(skb1)->seq,
+					 TCP_SKB_CB(skb1)->end_seq);
+			__kfree_skb(skb1);
 		}
 
 add_sack: