[TCP]: Fix new packet len calc in tcp_fragment()

The following patch makes it allocate skb_headlen(skb) - len instead
of skb->len - len.  When skb is linear there is no difference.  When
it's non-linear we only ever copy the bytes in the header.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/ipv4/tcp_output.c

@@ -455,9 +455,13 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
 {
 	struct tcp_opt *tp = tcp_sk(sk);
 	struct sk_buff *buff;
-	int nsize = skb->len - len;
+	int nsize;
 	u16 flags;
 
+	nsize = skb_headlen(skb) - len;
+	if (nsize < 0)
+		nsize = 0;
+
 	if (skb_cloned(skb) &&
 	    skb_is_nonlinear(skb) &&
 	    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))