bughelp wanted
Description
tcp_cleanup_rbuf is called several times in a loop inside tcp_recvmsg. At the same time, it is passed the accumulated parameter "copied". Thus, the same data is taken into account several times.
int tcp_recvmsg(...) {
...
int copied = 0;
...
do {
...
tcp_cleanup_rbuf(sk, copied);
...
copied += used;
...
} while (len > 0);
tcp_cleanup_rbuf(sk, copied);
return copied;
...
}