* 1. Reno does not count dupacks (sacked_out) automatically. */
        if (!tp->packets_out)
                tp->sacked_out = 0;
-       /* 2. SACK counts snd_fack in packets inaccurately. */
-       if (tp->sacked_out == 0)
+
+       if (WARN_ON(!tp->sacked_out && tp->fackets_out))
                tp->fackets_out = 0;
 
        /* Now state machine starts.
                } else if (*seq_rtt < 0)
                        *seq_rtt = now - scb->when;
 
-               if (tp->fackets_out) {
-                       __u32 dval = min(tp->fackets_out, packets_acked);
-                       tp->fackets_out -= dval;
-               }
                /* hint's skb might be NULL but we don't need to care */
                tp->fastpath_cnt_hint -= min_t(u32, packets_acked,
                                               tp->fastpath_cnt_hint);
                        seq_rtt = now - scb->when;
                        last_ackt = skb->tstamp;
                }
-               tcp_dec_pcount_approx(&tp->fackets_out, skb);
                tp->packets_out -= tcp_skb_pcount(skb);
                tcp_unlink_write_queue(skb, sk);
                sk_stream_free_skb(sk, skb);
                tcp_ack_update_rtt(sk, acked, seq_rtt);
                tcp_rearm_rto(sk);
 
+               tp->fackets_out -= min(pkts_acked, tp->fackets_out);
                if (tcp_is_reno(tp))
                        tcp_remove_reno_sacks(sk, pkts_acked);
 
 
        }
 }
 
+/* When a modification to fackets out becomes necessary, we need to check
+ * skb is counted to fackets_out or not. Another important thing is to
+ * tweak SACK fastpath hint too as it would overwrite all changes unless
+ * hint is also changed.
+ */
+static void tcp_adjust_fackets_out(struct tcp_sock *tp, struct sk_buff *skb,
+                                  int decr)
+{
+       if (!tp->sacked_out)
+               return;
+
+       if (!before(tp->highest_sack, TCP_SKB_CB(skb)->seq))
+               tp->fackets_out -= decr;
+
+       /* cnt_hint is "off-by-one" compared with fackets_out (see sacktag) */
+       if (tp->fastpath_skb_hint != NULL &&
+           after(TCP_SKB_CB(tp->fastpath_skb_hint)->seq, TCP_SKB_CB(skb)->seq))
+               tp->fastpath_cnt_hint -= decr;
+}
+
 /* Function to create two new TCP segments.  Shrinks the given segment
  * to the specified size and appends a new segment with the rest of the
  * packet to the list.  This won't be called frequently, I hope.
                if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST)
                        tp->lost_out -= diff;
 
-               if (diff > 0) {
-                       /* Adjust Reno SACK estimate. */
-                       if (tcp_is_reno(tp)) {
-                               tcp_dec_pcount_approx_int(&tp->sacked_out, diff);
-                               tcp_verify_left_out(tp);
-                       }
-
-                       tcp_dec_pcount_approx_int(&tp->fackets_out, diff);
-                       /* SACK fastpath might overwrite it unless dealt with */
-                       if (tp->fastpath_skb_hint != NULL &&
-                           after(TCP_SKB_CB(tp->fastpath_skb_hint)->seq,
-                                 TCP_SKB_CB(skb)->seq)) {
-                               tcp_dec_pcount_approx_int(&tp->fastpath_cnt_hint, diff);
-                       }
+               /* Adjust Reno SACK estimate. */
+               if (tcp_is_reno(tp) && diff > 0) {
+                       tcp_dec_pcount_approx_int(&tp->sacked_out, diff);
+                       tcp_verify_left_out(tp);
                }
+               tcp_adjust_fackets_out(tp, skb, diff);
        }
 
        /* Link BUFF into the send queue. */
                if (tcp_is_reno(tp) && tp->sacked_out)
                        tcp_dec_pcount_approx(&tp->sacked_out, next_skb);
 
-               /* Not quite right: it can be > snd.fack, but
-                * it is better to underestimate fackets.
-                */
-               tcp_dec_pcount_approx(&tp->fackets_out, next_skb);
+               tcp_adjust_fackets_out(tp, skb, tcp_skb_pcount(next_skb));
                tp->packets_out -= tcp_skb_pcount(next_skb);
                sk_stream_free_skb(sk, next_skb);
        }