struct tcphdr {
    __be16  source;
    __be16  dest;
    __be32  seq;
    __be32  ack_seq;
    __u16   doff:4,
        res1:4,
        cwr:1,
        ece:1,
        urg:1,
        ack:1,
        psh:1,
        rst:1,
        syn:1,
        fin:1;
    __be16  window;
    __sum16 check;
    __be16  urg_ptr;
};

/* Collapse ofo queue. Algorithm: select contiguous sequence of skbs
 * and tcp_collapse() them until all the queue is collapsed.
 */
static void tcp_collapse_ofo_queue(struct sock *sk)
 {
    struct tcp_sock *tp = tcp_sk(sk);
+   u32 range_truesize, sum_tiny = 0;
    struct sk_buff *skb, *head;
    u32 start, end;

    p = rb_first(&tp->out_of_order_queue);
    skb = rb_entry_safe(p, struct sk_buff, rbnode);
new_range:
    if (!skb) {
        p = rb_last(&tp->out_of_order_queue);
        /* Note: This is possible p is NULL here. We do not
         * use rb_entry_safe(), as ooo_last_skb is valid only
         * if rbtree is not empty.
         */
        tp->ooo_last_skb = rb_entry(p, struct sk_buff, rbnode);
        return;
    }
    start = TCP_SKB_CB(skb)->seq;
    end = TCP_SKB_CB(skb)->end_seq;
+   range_truesize = skb->truesize;

    for (head = skb;;) {
        skb = skb_rb_next(skb);

        /* Range is terminated when we see a gap or when
         * we are at the queue end.
         */
        if (!skb ||
            after(TCP_SKB_CB(skb)->seq, end) ||
            before(TCP_SKB_CB(skb)->end_seq, start)) {
-           tcp_collapse(sk, NULL, &tp->out_of_order_queue,
-                    head, skb, start, end);
+           /* Do not attempt collapsing tiny skbs */
+           if (range_truesize != head->truesize ||
+               end - start >= SKB_WITH_OVERHEAD(SK_MEM_QUANTUM)) {
+               tcp_collapse(sk, NULL, &tp->out_of_order_queue,
+                        head, skb, start, end);
+           } else {
+               sum_tiny += range_truesize;
+               if (sum_tiny > sk->sk_rcvbuf >> 3)
+                   return;
+           }
            goto new_range;
        }

+       range_truesize += skb->truesize;
        if (unlikely(before(TCP_SKB_CB(skb)->seq, start)))
            start = TCP_SKB_CB(skb)->seq;
        if (after(TCP_SKB_CB(skb)->end_seq, end))
            end = TCP_SKB_CB(skb)->end_seq;
    }
}

/*
 * Clean the out-of-order queue to make room.
 * We drop high sequences packets to :
 * 1) Let a chance for holes to be filled.
 * 2) not add too big latencies if thousands of packets sit there.
 *    (But if application shrinks SO_RCVBUF, we could still end up
 *     freeing whole queue here)
+ * 3) Drop at least 12.5 % of sk_rcvbuf to avoid malicious attacks.
 *
 * Return true if queue has shrunk.
 */
static bool tcp_prune_ofo_queue(struct sock *sk)
{
    struct tcp_sock *tp = tcp_sk(sk);
    struct rb_node *node, *prev;
+   int goal;

    if (RB_EMPTY_ROOT(&tp->out_of_order_queue))
        return false;

    NET_INC_STATS(sock_net(sk), LINUX_MIB_OFOPRUNED);
+   goal = sk->sk_rcvbuf >> 3; // size of receive buffer in bytes

    node = &tp->ooo_last_skb->rbnode;
    do {
        prev = rb_prev(node);
        rb_erase(node, &tp->out_of_order_queue);
+       goal -= rb_to_skb(node)->truesize;
        tcp_drop(sk, rb_to_skb(node));
-       sk_mem_reclaim(sk);
-       if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
-           !tcp_under_memory_pressure(sk))
-           break;
+       if (!prev || goal <= 0) {
+           sk_mem_reclaim(sk);
+           if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
+               !tcp_under_memory_pressure(sk))
+               break;
+           goal = sk->sk_rcvbuf >> 3;
+       }
        node = prev;
    } while (node);
    tp->ooo_last_skb = rb_entry(prev, struct sk_buff, rbnode);

    /* Reset SACK state.  A conforming SACK implementation will
     * do the same at a timeout based retransmit.  When a connection
     * is in a sad state like this, we care only about integrity
     * of the connection not performance.
     */
    if (tp->rx_opt.sack_ok)
        tcp_sack_reset(&tp->rx_opt);
    return true;
}