The TCP_OFF assignment at the bottom of that if block can indeed set
TCP_OFF without setting TCP_PAGE.  Since there is not much to be
gained from avoiding this situation, we might as well just zap the
offset.  The following patch should fix it.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
                                        if (off == PAGE_SIZE) {
                                                put_page(page);
                                                TCP_PAGE(sk) = page = NULL;
-                                               TCP_OFF(sk) = off = 0;
+                                               off = 0;
                                        }
                                } else
-                                       BUG_ON(off);
+                                       off = 0;
 
                                if (copy > PAGE_SIZE - off)
                                        copy = PAGE_SIZE - off;