Could xfer.rx_buf for the data path point to the currently allocacted socket buff struct spi_transfer xfer = { 0 }; struct spi_message msg; if (header_type == OA_TC6_DATA_HEADER) { xfer.tx_buf = tc6->spi_data_tx_buf; xfer.rx_buf = tc6->spi_data_rx_buf; } else { xfer.tx_buf = tc6->spi_ctrl_tx_buf; xfer.rx_buf = tc6->spi_ctrl_rx_buf; } xfer.len = length; To avoid an additional copy here? > +static void oa_tc6_update_rx_skb(struct oa_tc6 *tc6, u8 *payload, u8 length) > +{ > + memcpy(skb_put(tc6->rx_skb, length), payload, length); > +} > R