[PATCH] tcp: drain out_of_order_queue and update SACKs in tcp_send_rcvq()

[Hui Peng <benquike@gmail.com>]

When TCP_REPAIR injects data into the receive queue via tcp_send_rcvq() and
advances tp->copied_seq and tp->rcv_nxt, any segments already sitting in
tp->out_of_order_queue that are now covered or contiguous with rcv_nxt are
not coalesced or removed from tp->rx_opt.num_sacks. Drain
out_of_order_queue via tcp_ofo_queue(sk) and update SACK blocks via
tcp_sack_remove(tp) after advancing rcv_nxt in tcp_send_rcvq().

Fixes: 292e8d8c8538 ("tcp: Move rcvq sending to tcp_input.c")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 92bc60716f33..8a7c38a4b1ec 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5589,6 +5589,11 @@ int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size)
 		WARN_ON_ONCE(fragstolen); /* should not happen */
 		__kfree_skb(skb);
 	}
+	if (!RB_EMPTY_ROOT(&tcp_sk(sk)->out_of_order_queue)) {
+		tcp_ofo_queue(sk);
+		if (tcp_sk(sk)->rx_opt.num_sacks)
+			tcp_sack_remove(tcp_sk(sk));
+	}
 	return size;
 
 err_free: