diff --git a/include/net/tcp.h b/include/net/tcp.h
index b1a05f8b35f0cd000210fe49ff747fcb79f4b5c2..78d13c88720fda50e3f1880ac741cea1985ef3e9 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1326,7 +1326,9 @@ static inline unsigned long tcp_probe0_base(const struct sock *sk)
 static inline unsigned long tcp_probe0_when(const struct sock *sk,
 					    unsigned long max_when)
 {
-	u64 when = (u64)tcp_probe0_base(sk) << inet_csk(sk)->icsk_backoff;
+	u8 backoff = min_t(u8, ilog2(TCP_RTO_MAX / TCP_RTO_MIN) + 1,
+			   inet_csk(sk)->icsk_backoff);
+	u64 when = (u64)tcp_probe0_base(sk) << backoff;
 
 	return (unsigned long)min_t(u64, when, max_when);
 }