mptcp_sk(sk)->timer_ival = tout > 0 ? tout : TCP_RTO_MIN;
 }
 
-static void mptcp_send_ack(struct mptcp_sock *msk)
+static bool mptcp_subflow_active(struct mptcp_subflow_context *subflow)
+{
+       struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
+
+       /* can't send if JOIN hasn't completed yet (i.e. is usable for mptcp) */
+       if (subflow->request_join && !subflow->fully_established)
+               return false;
+
+       /* only send if our side has not closed yet */
+       return ((1 << ssk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT));
+}
+
+static void mptcp_send_ack(struct mptcp_sock *msk, bool force)
 {
        struct mptcp_subflow_context *subflow;
+       struct sock *pick = NULL;
 
        mptcp_for_each_subflow(msk, subflow) {
                struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
 
-               lock_sock(ssk);
-               tcp_send_ack(ssk);
-               release_sock(ssk);
+               if (force) {
+                       lock_sock(ssk);
+                       tcp_send_ack(ssk);
+                       release_sock(ssk);
+                       continue;
+               }
+
+               /* if the hintes ssk is still active, use it */
+               pick = ssk;
+               if (ssk == msk->ack_hint)
+                       break;
+       }
+       if (!force && pick) {
+               lock_sock(pick);
+               tcp_cleanup_rbuf(pick, 1);
+               release_sock(pick);
        }
 }
 
 
                ret = true;
                mptcp_set_timeout(sk, NULL);
-               mptcp_send_ack(msk);
+               mptcp_send_ack(msk, true);
                mptcp_close_wake_up(sk);
        }
        return ret;
        unsigned int moved = 0;
        bool more_data_avail;
        struct tcp_sock *tp;
-       u32 old_copied_seq;
        bool done = false;
        int sk_rbuf;
 
 
        pr_debug("msk=%p ssk=%p", msk, ssk);
        tp = tcp_sk(ssk);
-       old_copied_seq = tp->copied_seq;
        do {
                u32 map_remaining, offset;
                u32 seq = tp->copied_seq;
                        break;
                }
        } while (more_data_avail);
+       msk->ack_hint = ssk;
 
        *bytes += moved;
-       if (tp->copied_seq != old_copied_seq)
-               tcp_cleanup_rbuf(ssk, 1);
-
        return done;
 }
 
        if (atomic_read(&sk->sk_rmem_alloc) > sk_rbuf)
                goto wake;
 
-       if (move_skbs_to_msk(msk, ssk))
-               goto wake;
+       move_skbs_to_msk(msk, ssk);
 
-       /* mptcp socket is owned, release_cb should retry */
-       if (!test_and_set_bit(TCP_DELACK_TIMER_DEFERRED,
-                             &sk->sk_tsq_flags)) {
-               sock_hold(sk);
-
-               /* need to try again, its possible release_cb() has already
-                * been called after the test_and_set_bit() above.
-                */
-               move_skbs_to_msk(msk, ssk);
-       }
 wake:
        if (wake)
                sk->sk_data_ready(sk);
        mptcp_clean_una((struct sock *)msk);
 }
 
-static bool mptcp_subflow_active(struct mptcp_subflow_context *subflow)
-{
-       struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
-
-       /* can't send if JOIN hasn't completed yet (i.e. is usable for mptcp) */
-       if (subflow->request_join && !subflow->fully_established)
-               return false;
-
-       /* only send if our side has not closed yet */
-       return ((1 << ssk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT));
-}
-
 #define MPTCP_SEND_BURST_SIZE          ((1 << 16) - \
                                         sizeof(struct tcphdr) - \
                                         MAX_TCP_OPTION_SPACE - \
        msk->rcvq_space.time = mstamp;
 }
 
-static bool __mptcp_move_skbs(struct mptcp_sock *msk)
+static bool __mptcp_move_skbs(struct mptcp_sock *msk, unsigned int rcv)
 {
        unsigned int moved = 0;
        bool done;
 
                slowpath = lock_sock_fast(ssk);
                done = __mptcp_move_skbs_from_subflow(msk, ssk, &moved);
+               if (moved && rcv) {
+                       WRITE_ONCE(msk->rmem_pending, min(rcv, moved));
+                       tcp_cleanup_rbuf(ssk, 1);
+                       WRITE_ONCE(msk->rmem_pending, 0);
+               }
                unlock_sock_fast(ssk, slowpath);
        } while (!done);
 
        if (mptcp_ofo_queue(msk) || moved > 0) {
-               if (!mptcp_check_data_fin((struct sock *)msk))
-                       mptcp_send_ack(msk);
+               mptcp_check_data_fin((struct sock *)msk);
                return true;
        }
        return false;
        target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
        __mptcp_flush_join_list(msk);
 
-       while (len > (size_t)copied) {
-               int bytes_read;
+       for (;;) {
+               int bytes_read, old_space;
 
                bytes_read = __mptcp_recvmsg_mskq(msk, msg, len - copied);
                if (unlikely(bytes_read < 0)) {
                copied += bytes_read;
 
                if (skb_queue_empty(&sk->sk_receive_queue) &&
-                   __mptcp_move_skbs(msk))
+                   __mptcp_move_skbs(msk, len - copied))
                        continue;
 
+               /* be sure to advertise window change */
+               old_space = READ_ONCE(msk->old_wspace);
+               if ((tcp_space(sk) - old_space) >= old_space)
+                       mptcp_send_ack(msk, false);
+
                /* only the master socket status is relevant here. The exit
                 * conditions mirror closely tcp_recvmsg()
                 */
                /* .. race-breaker: ssk might have gotten new data
                 * after last __mptcp_move_skbs() returned false.
                 */
-               if (unlikely(__mptcp_move_skbs(msk)))
+               if (unlikely(__mptcp_move_skbs(msk, 0)))
                        set_bit(MPTCP_DATA_READY, &msk->flags);
        } else if (unlikely(!test_bit(MPTCP_DATA_READY, &msk->flags))) {
                /* data to read but mptcp_wait_data() cleared DATA_READY */
        if (test_and_clear_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags))
                __mptcp_close_subflow(msk);
 
-       __mptcp_move_skbs(msk);
        if (mptcp_send_head(sk))
                mptcp_push_pending(sk, 0);
 
        msk->out_of_order_queue = RB_ROOT;
        msk->first_pending = NULL;
 
+       msk->ack_hint = NULL;
        msk->first = NULL;
        inet_csk(sk)->icsk_sync_mss = mptcp_sync_mss;
 
        return -EOPNOTSUPP;
 }
 
-#define MPTCP_DEFERRED_ALL (TCPF_DELACK_TIMER_DEFERRED | \
-                           TCPF_WRITE_TIMER_DEFERRED)
+#define MPTCP_DEFERRED_ALL (TCPF_WRITE_TIMER_DEFERRED)
 
 /* this is very alike tcp_release_cb() but we must handle differently a
  * different set of events
 
        sock_release_ownership(sk);
 
-       if (flags & TCPF_DELACK_TIMER_DEFERRED) {
-               struct mptcp_sock *msk = mptcp_sk(sk);
-               struct sock *ssk;
-
-               ssk = mptcp_subflow_recv_lookup(msk);
-               if (!ssk || sk->sk_state == TCP_CLOSE ||
-                   !schedule_work(&msk->work))
-                       __sock_put(sk);
-       }
-
        if (flags & TCPF_WRITE_TIMER_DEFERRED) {
                mptcp_retransmit_handler(sk);
                __sock_put(sk);