From: "Steven J. Magnani" <redacted>
Date: Tue, 30 Mar 2010 15:45:13 -0500

tcp_read_sock() can have a eat skbs without immediately advancing copied_seq.
This can cause a panic in tcp_collapse() if it is called as a result
of the recv_actor dropping the socket lock.

A userspace program that splices data from a socket to either another
socket or to a file can trigger this bug.

Signed-off-by: Steven J. Magnani <redacted>

Thanks for fixing this I'll look at your patch more closely
right now.