Merge tag 'v5.3-rc7' into devel

Linux 5.3-rc7

1 files changed, 193 insertions, 166 deletions

diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 5bd6f1546e5c..d122c53c8697 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -196,15 +196,14 @@ send_extra_data:
  * Ping the other end to fill our RTT cache and to retrieve the rwind
  * and MTU parameters.
  */
-static void rxrpc_send_ping(struct rxrpc_call *call, struct sk_buff *skb,
-                            int skew)
+static void rxrpc_send_ping(struct rxrpc_call *call, struct sk_buff *skb)
 {
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
         ktime_t now = skb->tstamp;
 
         if (call->peer->rtt_usage < 3 ||
             ktime_before(ktime_add_ms(call->peer->rtt_last_req, 1000), now))
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, skew, sp->hdr.serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, sp->hdr.serial,
                                   true, true,
                                   rxrpc_propose_ack_ping_for_params);
 }
@@ -234,7 +233,7 @@ static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to,
                 ix = call->tx_hard_ack & RXRPC_RXTX_BUFF_MASK;
                 skb = call->rxtx_buffer[ix];
                 annotation = call->rxtx_annotations[ix];
-                rxrpc_see_skb(skb, rxrpc_skb_tx_rotated);
+                rxrpc_see_skb(skb, rxrpc_skb_rotated);
                 call->rxtx_buffer[ix] = NULL;
                 call->rxtx_annotations[ix] = 0;
                 skb->next = list;
@@ -259,7 +258,7 @@ static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to,
                 skb = list;
                 list = skb->next;
                 skb_mark_not_on_list(skb);
-                rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
         }
 
         return rot_last;
@@ -348,7 +347,7 @@ static bool rxrpc_receiving_reply(struct rxrpc_call *call)
 }
 
 /*
- * Scan a jumbo packet to validate its structure and to work out how many
+ * Scan a data packet to validate its structure and to work out how many
  * subpackets it contains.
  *
  * A jumbo packet is a collection of consecutive packets glued together with
@@ -359,16 +358,21 @@ static bool rxrpc_receiving_reply(struct rxrpc_call *call)
  * the last are RXRPC_JUMBO_DATALEN in size.  The last subpacket may be of any
  * size.
  */
-static bool rxrpc_validate_jumbo(struct sk_buff *skb)
+static bool rxrpc_validate_data(struct sk_buff *skb)
 {
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
         unsigned int offset = sizeof(struct rxrpc_wire_header);
         unsigned int len = skb->len;
-        int nr_jumbo = 1;
         u8 flags = sp->hdr.flags;
 
-        do {
-                nr_jumbo++;
+        for (;;) {
+                if (flags & RXRPC_REQUEST_ACK)
+                        __set_bit(sp->nr_subpackets, sp->rx_req_ack);
+                sp->nr_subpackets++;
+
+                if (!(flags & RXRPC_JUMBO_PACKET))
+                        break;
+
                 if (len - offset < RXRPC_JUMBO_SUBPKTLEN)
                         goto protocol_error;
                 if (flags & RXRPC_LAST_PACKET)
@@ -377,9 +381,10 @@ static bool rxrpc_validate_jumbo(struct sk_buff *skb)
                 if (skb_copy_bits(skb, offset, &flags, 1) < 0)
                         goto protocol_error;
                 offset += sizeof(struct rxrpc_jumbo_header);
-        } while (flags & RXRPC_JUMBO_PACKET);
+        }
 
-        sp->nr_jumbo = nr_jumbo;
+        if (flags & RXRPC_LAST_PACKET)
+                sp->rx_flags |= RXRPC_SKB_INCL_LAST;
         return true;
 
 protocol_error:
@@ -400,10 +405,10 @@ protocol_error:
  * (that information is encoded in the ACK packet).
  */
 static void rxrpc_input_dup_data(struct rxrpc_call *call, rxrpc_seq_t seq,
-                                 u8 annotation, bool *_jumbo_bad)
+                                 bool is_jumbo, bool *_jumbo_bad)
 {
         /* Discard normal packets that are duplicates. */
-        if (annotation == 0)
+        if (is_jumbo)
                 return;
 
         /* Skip jumbo subpackets that are duplicates.  When we've had three or
@@ -417,30 +422,30 @@ static void rxrpc_input_dup_data(struct rxrpc_call *call, rxrpc_seq_t seq,
 }
 
 /*
- * Process a DATA packet, adding the packet to the Rx ring.
+ * Process a DATA packet, adding the packet to the Rx ring.  The caller's
+ * packet ref must be passed on or discarded.
  */
-static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
-                             u16 skew)
+static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb)
 {
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
         enum rxrpc_call_state state;
-        unsigned int offset = sizeof(struct rxrpc_wire_header);
-        unsigned int ix;
+        unsigned int j;
         rxrpc_serial_t serial = sp->hdr.serial, ack_serial = 0;
-        rxrpc_seq_t seq = sp->hdr.seq, hard_ack;
-        bool immediate_ack = false, jumbo_bad = false, queued;
-        u16 len;
-        u8 ack = 0, flags, annotation = 0;
+        rxrpc_seq_t seq0 = sp->hdr.seq, hard_ack;
+        bool immediate_ack = false, jumbo_bad = false;
+        u8 ack = 0;
 
         _enter("{%u,%u},{%u,%u}",
-               call->rx_hard_ack, call->rx_top, skb->len, seq);
+               call->rx_hard_ack, call->rx_top, skb->len, seq0);
 
-        _proto("Rx DATA %%%u { #%u f=%02x }",
-               sp->hdr.serial, seq, sp->hdr.flags);
+        _proto("Rx DATA %%%u { #%u f=%02x n=%u }",
+               sp->hdr.serial, seq0, sp->hdr.flags, sp->nr_subpackets);
 
         state = READ_ONCE(call->state);
-        if (state >= RXRPC_CALL_COMPLETE)
+        if (state >= RXRPC_CALL_COMPLETE) {
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
                 return;
+        }
 
         if (call->state == RXRPC_CALL_SERVER_RECV_REQUEST) {
                 unsigned long timo = READ_ONCE(call->next_req_timo);
@@ -465,156 +470,157 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
             !rxrpc_receiving_reply(call))
                 goto unlock;
 
-        call->ackr_prev_seq = seq;
-
+        call->ackr_prev_seq = seq0;
         hard_ack = READ_ONCE(call->rx_hard_ack);
-        if (after(seq, hard_ack + call->rx_winsize)) {
-                ack = RXRPC_ACK_EXCEEDS_WINDOW;
-                ack_serial = serial;
-                goto ack;
-        }
 
-        flags = sp->hdr.flags;
-        if (flags & RXRPC_JUMBO_PACKET) {
+        if (sp->nr_subpackets > 1) {
                 if (call->nr_jumbo_bad > 3) {
                         ack = RXRPC_ACK_NOSPACE;
                         ack_serial = serial;
                         goto ack;
                 }
-                annotation = 1;
         }
 
-next_subpacket:
-        queued = false;
-        ix = seq & RXRPC_RXTX_BUFF_MASK;
-        len = skb->len;
-        if (flags & RXRPC_JUMBO_PACKET)
-                len = RXRPC_JUMBO_DATALEN;
-
-        if (flags & RXRPC_LAST_PACKET) {
-                if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
-                    seq != call->rx_top) {
-                        rxrpc_proto_abort("LSN", call, seq);
-                        goto unlock;
-                }
-        } else {
-                if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
-                    after_eq(seq, call->rx_top)) {
-                        rxrpc_proto_abort("LSA", call, seq);
-                        goto unlock;
+        for (j = 0; j < sp->nr_subpackets; j++) {
+                rxrpc_serial_t serial = sp->hdr.serial + j;
+                rxrpc_seq_t seq = seq0 + j;
+                unsigned int ix = seq & RXRPC_RXTX_BUFF_MASK;
+                bool terminal = (j == sp->nr_subpackets - 1);
+                bool last = terminal && (sp->rx_flags & RXRPC_SKB_INCL_LAST);
+                u8 flags, annotation = j;
+
+                _proto("Rx DATA+%u %%%u { #%x t=%u l=%u }",
+                     j, serial, seq, terminal, last);
+
+                if (last) {
+                        if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
+                            seq != call->rx_top) {
+                                rxrpc_proto_abort("LSN", call, seq);
+                                goto unlock;
+                        }
+                } else {
+                        if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
+                            after_eq(seq, call->rx_top)) {
+                                rxrpc_proto_abort("LSA", call, seq);
+                                goto unlock;
+                        }
                 }
-        }
-
-        trace_rxrpc_rx_data(call->debug_id, seq, serial, flags, annotation);
-        if (before_eq(seq, hard_ack)) {
-                ack = RXRPC_ACK_DUPLICATE;
-                ack_serial = serial;
-                goto skip;
-        }
 
-        if (flags & RXRPC_REQUEST_ACK && !ack) {
-                ack = RXRPC_ACK_REQUESTED;
-                ack_serial = serial;
-        }
+                flags = 0;
+                if (last)
+                        flags |= RXRPC_LAST_PACKET;
+                if (!terminal)
+                        flags |= RXRPC_JUMBO_PACKET;
+                if (test_bit(j, sp->rx_req_ack))
+                        flags |= RXRPC_REQUEST_ACK;
+                trace_rxrpc_rx_data(call->debug_id, seq, serial, flags, annotation);
 
-        if (call->rxtx_buffer[ix]) {
-                rxrpc_input_dup_data(call, seq, annotation, &jumbo_bad);
-                if (ack != RXRPC_ACK_DUPLICATE) {
+                if (before_eq(seq, hard_ack)) {
                         ack = RXRPC_ACK_DUPLICATE;
                         ack_serial = serial;
+                        continue;
                 }
-                immediate_ack = true;
-                goto skip;
-        }
-
-        /* Queue the packet.  We use a couple of memory barriers here as need
-         * to make sure that rx_top is perceived to be set after the buffer
-         * pointer and that the buffer pointer is set after the annotation and
-         * the skb data.
-         *
-         * Barriers against rxrpc_recvmsg_data() and rxrpc_rotate_rx_window()
-         * and also rxrpc_fill_out_ack().
-         */
-        rxrpc_get_skb(skb, rxrpc_skb_rx_got);
-        call->rxtx_annotations[ix] = annotation;
-        smp_wmb();
-        call->rxtx_buffer[ix] = skb;
-        if (after(seq, call->rx_top)) {
-                smp_store_release(&call->rx_top, seq);
-        } else if (before(seq, call->rx_top)) {
-                /* Send an immediate ACK if we fill in a hole */
-                if (!ack) {
-                        ack = RXRPC_ACK_DELAY;
-                        ack_serial = serial;
-                }
-                immediate_ack = true;
-        }
-        if (flags & RXRPC_LAST_PACKET) {
-                set_bit(RXRPC_CALL_RX_LAST, &call->flags);
-                trace_rxrpc_receive(call, rxrpc_receive_queue_last, serial, seq);
-        } else {
-                trace_rxrpc_receive(call, rxrpc_receive_queue, serial, seq);
-        }
-        queued = true;
 
-        if (after_eq(seq, call->rx_expect_next)) {
-                if (after(seq, call->rx_expect_next)) {
-                        _net("OOS %u > %u", seq, call->rx_expect_next);
-                        ack = RXRPC_ACK_OUT_OF_SEQUENCE;
-                        ack_serial = serial;
+                if (call->rxtx_buffer[ix]) {
+                        rxrpc_input_dup_data(call, seq, sp->nr_subpackets > 1,
+                                             &jumbo_bad);
+                        if (ack != RXRPC_ACK_DUPLICATE) {
+                                ack = RXRPC_ACK_DUPLICATE;
+                                ack_serial = serial;
+                        }
+                        immediate_ack = true;
+                        continue;
                 }
-                call->rx_expect_next = seq + 1;
-        }
 
-skip:
-        offset += len;
-        if (flags & RXRPC_JUMBO_PACKET) {
-                if (skb_copy_bits(skb, offset, &flags, 1) < 0) {
-                        rxrpc_proto_abort("XJF", call, seq);
-                        goto unlock;
-                }
-                offset += sizeof(struct rxrpc_jumbo_header);
-                seq++;
-                serial++;
-                annotation++;
-                if (flags & RXRPC_JUMBO_PACKET)
-                        annotation |= RXRPC_RX_ANNO_JLAST;
                 if (after(seq, hard_ack + call->rx_winsize)) {
                         ack = RXRPC_ACK_EXCEEDS_WINDOW;
                         ack_serial = serial;
-                        if (!jumbo_bad) {
-                                call->nr_jumbo_bad++;
-                                jumbo_bad = true;
+                        if (flags & RXRPC_JUMBO_PACKET) {
+                                if (!jumbo_bad) {
+                                        call->nr_jumbo_bad++;
+                                        jumbo_bad = true;
+                                }
                         }
+
                         goto ack;
                 }
 
-                _proto("Rx DATA Jumbo %%%u", serial);
-                goto next_subpacket;
-        }
+                if (flags & RXRPC_REQUEST_ACK && !ack) {
+                        ack = RXRPC_ACK_REQUESTED;
+                        ack_serial = serial;
+                }
+
+                /* Queue the packet.  We use a couple of memory barriers here as need
+                 * to make sure that rx_top is perceived to be set after the buffer
+                 * pointer and that the buffer pointer is set after the annotation and
+                 * the skb data.
+                 *
+                 * Barriers against rxrpc_recvmsg_data() and rxrpc_rotate_rx_window()
+                 * and also rxrpc_fill_out_ack().
+                 */
+                if (!terminal)
+                        rxrpc_get_skb(skb, rxrpc_skb_got);
+                call->rxtx_annotations[ix] = annotation;
+                smp_wmb();
+                call->rxtx_buffer[ix] = skb;
+                if (after(seq, call->rx_top)) {
+                        smp_store_release(&call->rx_top, seq);
+                } else if (before(seq, call->rx_top)) {
+                        /* Send an immediate ACK if we fill in a hole */
+                        if (!ack) {
+                                ack = RXRPC_ACK_DELAY;
+                                ack_serial = serial;
+                        }
+                        immediate_ack = true;
+                }
 
-        if (queued && flags & RXRPC_LAST_PACKET && !ack) {
-                ack = RXRPC_ACK_DELAY;
-                ack_serial = serial;
+                if (terminal) {
+                        /* From this point on, we're not allowed to touch the
+                         * packet any longer as its ref now belongs to the Rx
+                         * ring.
+                         */
+                        skb = NULL;
+                }
+
+                if (last) {
+                        set_bit(RXRPC_CALL_RX_LAST, &call->flags);
+                        if (!ack) {
+                                ack = RXRPC_ACK_DELAY;
+                                ack_serial = serial;
+                        }
+                        trace_rxrpc_receive(call, rxrpc_receive_queue_last, serial, seq);
+                } else {
+                        trace_rxrpc_receive(call, rxrpc_receive_queue, serial, seq);
+                }
+
+                if (after_eq(seq, call->rx_expect_next)) {
+                        if (after(seq, call->rx_expect_next)) {
+                                _net("OOS %u > %u", seq, call->rx_expect_next);
+                                ack = RXRPC_ACK_OUT_OF_SEQUENCE;
+                                ack_serial = serial;
+                        }
+                        call->rx_expect_next = seq + 1;
+                }
         }
 
 ack:
         if (ack)
-                rxrpc_propose_ACK(call, ack, skew, ack_serial,
+                rxrpc_propose_ACK(call, ack, ack_serial,
                                   immediate_ack, true,
                                   rxrpc_propose_ack_input_data);
         else
-                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, skew, serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial,
                                   false, true,
                                   rxrpc_propose_ack_input_data);
 
-        if (sp->hdr.seq == READ_ONCE(call->rx_hard_ack) + 1) {
+        if (seq0 == READ_ONCE(call->rx_hard_ack) + 1) {
                 trace_rxrpc_notify_socket(call->debug_id, serial);
                 rxrpc_notify_socket(call);
         }
 
 unlock:
         spin_unlock(&call->input_lock);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
         _leave(" [queued]");
 }
 
@@ -822,8 +828,7 @@ static void rxrpc_input_soft_acks(struct rxrpc_call *call, u8 *acks,
  * soft-ACK means that the packet may be discarded and retransmission
  * requested.  A phase is complete when all packets are hard-ACK'd.
  */
-static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
-                            u16 skew)
+static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
 {
         struct rxrpc_ack_summary summary = { 0 };
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
@@ -867,11 +872,11 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
         if (buf.ack.reason == RXRPC_ACK_PING) {
                 _proto("Rx ACK %%%u PING Request", sp->hdr.serial);
                 rxrpc_propose_ACK(call, RXRPC_ACK_PING_RESPONSE,
-                                  skew, sp->hdr.serial, true, true,
+                                  sp->hdr.serial, true, true,
                                   rxrpc_propose_ack_respond_to_ping);
         } else if (sp->hdr.flags & RXRPC_REQUEST_ACK) {
                 rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED,
-                                  skew, sp->hdr.serial, true, true,
+                                  sp->hdr.serial, true, true,
                                   rxrpc_propose_ack_respond_to_ack);
         }
 
@@ -948,7 +953,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
             RXRPC_TX_ANNO_LAST &&
             summary.nr_acks == call->tx_top - hard_ack &&
             rxrpc_is_client_call(call))
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, skew, sp->hdr.serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, sp->hdr.serial,
                                   false, true,
                                   rxrpc_propose_ack_ping_for_lost_reply);
 
@@ -1004,7 +1009,7 @@ static void rxrpc_input_abort(struct rxrpc_call *call, struct sk_buff *skb)
  * Process an incoming call packet.
  */
 static void rxrpc_input_call_packet(struct rxrpc_call *call,
-                                    struct sk_buff *skb, u16 skew)
+                                    struct sk_buff *skb)
 {
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
         unsigned long timo;
@@ -1023,11 +1028,11 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call,
 
         switch (sp->hdr.type) {
         case RXRPC_PACKET_TYPE_DATA:
-                rxrpc_input_data(call, skb, skew);
-                break;
+                rxrpc_input_data(call, skb);
+                goto no_free;
 
         case RXRPC_PACKET_TYPE_ACK:
-                rxrpc_input_ack(call, skb, skew);
+                rxrpc_input_ack(call, skb);
                 break;
 
         case RXRPC_PACKET_TYPE_BUSY:
@@ -1051,6 +1056,8 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call,
                 break;
         }
 
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
+no_free:
         _leave("");
 }
 
@@ -1108,8 +1115,12 @@ static void rxrpc_post_packet_to_local(struct rxrpc_local *local,
 {
         _enter("%p,%p", local, skb);
 
-        skb_queue_tail(&local->event_queue, skb);
-        rxrpc_queue_local(local);
+        if (rxrpc_get_local_maybe(local)) {
+                skb_queue_tail(&local->event_queue, skb);
+                rxrpc_queue_local(local);
+        } else {
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
+        }
 }
 
 /*
@@ -1119,8 +1130,12 @@ static void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
 {
         CHECK_SLAB_OKAY(&local->usage);
 
-        skb_queue_tail(&local->reject_queue, skb);
-        rxrpc_queue_local(local);
+        if (rxrpc_get_local_maybe(local)) {
+                skb_queue_tail(&local->reject_queue, skb);
+                rxrpc_queue_local(local);
+        } else {
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
+        }
 }
 
 /*
@@ -1173,7 +1188,6 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
         struct rxrpc_peer *peer = NULL;
         struct rxrpc_sock *rx = NULL;
         unsigned int channel;
-        int skew = 0;
 
         _enter("%p", udp_sk);
 
@@ -1184,7 +1198,7 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
         if (skb->tstamp == 0)
                 skb->tstamp = ktime_get_real();
 
-        rxrpc_new_skb(skb, rxrpc_skb_rx_received);
+        rxrpc_new_skb(skb, rxrpc_skb_received);
 
         skb_pull(skb, sizeof(struct udphdr));
 
@@ -1201,7 +1215,7 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                 static int lose;
                 if ((lose++ & 7) == 7) {
                         trace_rxrpc_rx_lose(sp);
-                        rxrpc_free_skb(skb, rxrpc_skb_rx_lost);
+                        rxrpc_free_skb(skb, rxrpc_skb_lost);
                         return 0;
                 }
         }
@@ -1233,9 +1247,26 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                 if (sp->hdr.callNumber == 0 ||
                     sp->hdr.seq == 0)
                         goto bad_message;
-                if (sp->hdr.flags & RXRPC_JUMBO_PACKET &&
-                    !rxrpc_validate_jumbo(skb))
+                if (!rxrpc_validate_data(skb))
                         goto bad_message;
+
+                /* Unshare the packet so that it can be modified for in-place
+                 * decryption.
+                 */
+                if (sp->hdr.securityIndex != 0) {
+                        struct sk_buff *nskb = skb_unshare(skb, GFP_ATOMIC);
+                        if (!nskb) {
+                                rxrpc_eaten_skb(skb, rxrpc_skb_unshared_nomem);
+                                goto out;
+                        }
+
+                        if (nskb != skb) {
+                                rxrpc_eaten_skb(skb, rxrpc_skb_received);
+                                rxrpc_new_skb(skb, rxrpc_skb_unshared);
+                                skb = nskb;
+                                sp = rxrpc_skb(skb);
+                        }
+                }
                 break;
 
         case RXRPC_PACKET_TYPE_CHALLENGE:
@@ -1301,15 +1332,8 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                         goto out;
                 }
 
-                /* Note the serial number skew here */
-                skew = (int)sp->hdr.serial - (int)conn->hi_serial;
-                if (skew >= 0) {
-                        if (skew > 0)
-                                conn->hi_serial = sp->hdr.serial;
-                } else {
-                        skew = -skew;
-                        skew = min(skew, 65535);
-                }
+                if ((int)sp->hdr.serial - (int)conn->hi_serial > 0)
+                        conn->hi_serial = sp->hdr.serial;
 
                 /* Call-bound packets are routed by connection channel. */
                 channel = sp->hdr.cid & RXRPC_CHANNELMASK;
@@ -1372,15 +1396,18 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                 call = rxrpc_new_incoming_call(local, rx, skb);
                 if (!call)
                         goto reject_packet;
-                rxrpc_send_ping(call, skb, skew);
+                rxrpc_send_ping(call, skb);
                 mutex_unlock(&call->user_mutex);
         }
 
-        rxrpc_input_call_packet(call, skb, skew);
-        goto discard;
+        /* Process a call packet; this either discards or passes on the ref
+         * elsewhere.
+         */
+        rxrpc_input_call_packet(call, skb);
+        goto out;
 
 discard:
-        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
 out:
         trace_rxrpc_rx_done(0, 0);
         return 0;