1 files changed, 7 insertions, 0 deletions

diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index fc32aa5764a2..e60cf65c2232 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -460,6 +460,7 @@ static void rxrpc_insert_oos_packet(struct rxrpc_call *call,
         ASSERTCMP(sp->call, ==, NULL);
         sp->call = call;
         rxrpc_get_call(call);
+        atomic_inc(&call->skb_count);
 
         /* insert into the buffer in sequence order */
         spin_lock_bh(&call->lock);
@@ -734,6 +735,7 @@ all_acked:
                 skb->mark = RXRPC_SKB_MARK_FINAL_ACK;
                 sp->call = call;
                 rxrpc_get_call(call);
+                atomic_inc(&call->skb_count);
                 spin_lock_bh(&call->lock);
                 if (rxrpc_queue_rcv_skb(call, skb, true, true) < 0)
                         BUG();
@@ -793,6 +795,7 @@ static int rxrpc_post_message(struct rxrpc_call *call, u32 mark, u32 error,
                 sp->error = error;
                 sp->call = call;
                 rxrpc_get_call(call);
+                atomic_inc(&call->skb_count);
 
                 spin_lock_bh(&call->lock);
                 ret = rxrpc_queue_rcv_skb(call, skb, true, fatal);
@@ -834,6 +837,9 @@ void rxrpc_process_call(struct work_struct *work)
                 return;
         }
 
+        if (!call->conn)
+                goto skip_msg_init;
+
         /* there's a good chance we're going to have to send a message, so set
          * one up in advance */
         msg.msg_name    = &call->conn->params.peer->srx.transport;
@@ -856,6 +862,7 @@ void rxrpc_process_call(struct work_struct *work)
         memset(iov, 0, sizeof(iov));
         iov[0].iov_base = &whdr;
         iov[0].iov_len  = sizeof(whdr);
+skip_msg_init:
 
         /* deal with events of a final nature */
         if (test_bit(RXRPC_CALL_EV_RCVD_ERROR, &call->events)) {