Actually, there's another bug here too: if rxrpc_wait_for_tx_window() drops the call mutex then it needs to reload the pending packet state in rxrpc_send_data() as it may have raced with another sendmsg(). David