It seems that trivial reset of pcount to one was not sufficient
in tcp_retransmit_skb. Multiple counters experience a positive
miscount when skb's pcount gets lowered without the necessary
adjustments (depending on skb's sacked bits which exactly), at
worst a packets_out miscount can crash at RTO if the write queue
is empty!

Triggering this requires mss change, so bidir tcp or mtu probe or
like.
Signed-off-by: NIlpo Järvinen <ilpo.jarvinen@helsinki.fi>
Reported-by: NMarkus Trippelsdorf <markus@trippelsdorf.de>
Tested-by: NUwe Bugla <uwe.bugla@gmx.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>