static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
 {
        struct sockaddr_rxrpc *srx = (struct sockaddr_rxrpc *)saddr;
-       struct sock *sk = sock->sk;
        struct rxrpc_local *local;
-       struct rxrpc_sock *rx = rxrpc_sk(sk);
+       struct rxrpc_sock *rx = rxrpc_sk(sock->sk);
        u16 service_id = srx->srx_service;
        int ret;
 
 
        memcpy(&rx->srx, srx, sizeof(rx->srx));
 
-       local = rxrpc_lookup_local(sock_net(sock->sk), &rx->srx);
+       local = rxrpc_lookup_local(sock_net(&rx->sk), &rx->srx);
        if (IS_ERR(local)) {
                ret = PTR_ERR(local);
                goto error_unlock;
 
                u32                     call_counter;   /* Call ID counter */
                u32                     last_call;      /* ID of last call */
                u8                      last_type;      /* Type of last packet */
-               u16                     last_service_id;
                union {
                        u32             last_seq;
                        u32             last_abort;
        atomic_t                serial;         /* packet serial number counter */
        unsigned int            hi_serial;      /* highest serial number received */
        u32                     security_nonce; /* response re-use preventer */
+       u16                     service_id;     /* Service ID, possibly upgraded */
        u8                      size_align;     /* data size alignment (for security) */
        u8                      security_size;  /* security header size */
        u8                      security_ix;    /* security type */
 
        conn->params            = *cp;
        conn->out_clientflag    = RXRPC_CLIENT_INITIATED;
        conn->state             = RXRPC_CONN_CLIENT;
+       conn->service_id        = cp->service_id;
 
        ret = rxrpc_get_client_connection_id(conn, gfp);
        if (ret < 0)
        if (cp->exclusive) {
                call->conn = candidate;
                call->security_ix = candidate->security_ix;
+               call->service_id = candidate->service_id;
                _leave(" = 0 [exclusive %d]", candidate->debug_id);
                return 0;
        }
        set_bit(RXRPC_CONN_IN_CLIENT_CONNS, &candidate->flags);
        call->conn = candidate;
        call->security_ix = candidate->security_ix;
+       call->service_id = candidate->service_id;
        spin_unlock(&local->client_conns_lock);
        _leave(" = 0 [new %d]", candidate->debug_id);
        return 0;
        spin_lock(&conn->channel_lock);
        call->conn = conn;
        call->security_ix = conn->security_ix;
+       call->service_id = conn->service_id;
        list_add(&call->chan_wait_link, &conn->waiting_calls);
        spin_unlock(&conn->channel_lock);
        _leave(" = 0 [extant %d]", conn->debug_id);
 
        pkt.whdr.userStatus     = 0;
        pkt.whdr.securityIndex  = conn->security_ix;
        pkt.whdr._rsvd          = 0;
-       pkt.whdr.serviceId      = htons(chan->last_service_id);
+       pkt.whdr.serviceId      = htons(conn->service_id);
 
        len = sizeof(pkt.whdr);
        switch (chan->last_type) {
        whdr.userStatus = 0;
        whdr.securityIndex = conn->security_ix;
        whdr._rsvd      = 0;
-       whdr.serviceId  = htons(conn->params.service_id);
+       whdr.serviceId  = htons(conn->service_id);
 
        word            = htonl(conn->local_abort);
 
 
                 * through the channel, whilst disposing of the actual call record.
                 */
                trace_rxrpc_disconnect_call(call);
-               chan->last_service_id = call->service_id;
                if (call->abort_code) {
                        chan->last_abort = call->abort_code;
                        chan->last_type = RXRPC_PACKET_TYPE_ABORT;
 
        conn->proto.epoch       = sp->hdr.epoch;
        conn->proto.cid         = sp->hdr.cid & RXRPC_CIDMASK;
        conn->params.service_id = sp->hdr.serviceId;
+       conn->service_id        = sp->hdr.serviceId;
        conn->security_ix       = sp->hdr.securityIndex;
        conn->out_clientflag    = 0;
        if (conn->security_ix)
 
                   " %s %08x %08x %08x\n",
                   lbuff,
                   rbuff,
-                  conn->params.service_id,
+                  conn->service_id,
                   conn->proto.cid,
                   rxrpc_conn_is_service(conn) ? "Svc" : "Clt",
                   atomic_read(&conn->usage),
 
        }
 
        if (msg->msg_name) {
-               size_t len = sizeof(call->conn->params.peer->srx);
-               memcpy(msg->msg_name, &call->conn->params.peer->srx, len);
+               struct sockaddr_rxrpc *srx = msg->msg_name;
+               size_t len = sizeof(call->peer->srx);
+
+               memcpy(msg->msg_name, &call->peer->srx, len);
+               srx->srx_service = call->service_id;
                msg->msg_namelen = len;
        }
 
 
        whdr.userStatus = 0;
        whdr.securityIndex = conn->security_ix;
        whdr._rsvd      = 0;
-       whdr.serviceId  = htons(conn->params.service_id);
+       whdr.serviceId  = htons(conn->service_id);
 
        iov[0].iov_base = &whdr;
        iov[0].iov_len  = sizeof(whdr);
 
 
        _enter("");
 
-       sprintf(kdesc, "%u:%u", conn->params.service_id, conn->security_ix);
+       sprintf(kdesc, "%u:%u", conn->service_id, conn->security_ix);
 
        sec = rxrpc_security_lookup(conn->security_ix);
        if (!sec) {
        read_lock(&local->services_lock);
        rx = rcu_dereference_protected(local->service,
                                       lockdep_is_held(&local->services_lock));
-       if (rx && rx->srx.srx_service == conn->params.service_id)
+       if (rx && rx->srx.srx_service == conn->service_id)
                goto found_service;
 
        /* the service appears to have died */