diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c b/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c
index 82df3768ba26..4c600c6131e9 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c
@@ -1914,6 +1914,7 @@ static void ipa3_replenish_wlan_rx_cache(struct ipa3_sys_context *sys)
 				gsi_xfer_elem_one.addr = rx_pkt->data.dma_addr;
 				gsi_xfer_elem_one.len = IPA_WLAN_RX_BUFF_SZ;
 				gsi_xfer_elem_one.flags |= GSI_XFER_FLAG_EOT;
+				gsi_xfer_elem_one.flags |= GSI_XFER_FLAG_EOB;
 				gsi_xfer_elem_one.type = GSI_XFER_ELEM_DATA;
 				gsi_xfer_elem_one.xfer_user_data = rx_pkt;
 
@@ -2101,6 +2102,7 @@ static void ipa3_replenish_rx_cache(struct ipa3_sys_context *sys)
 			gsi_xfer_elem_one.addr = rx_pkt->data.dma_addr;
 			gsi_xfer_elem_one.len = sys->rx_buff_sz;
 			gsi_xfer_elem_one.flags |= GSI_XFER_FLAG_EOT;
+			gsi_xfer_elem_one.flags |= GSI_XFER_FLAG_EOB;
 			gsi_xfer_elem_one.type = GSI_XFER_ELEM_DATA;
 			gsi_xfer_elem_one.xfer_user_data = rx_pkt;
 
@@ -2207,6 +2209,7 @@ static void ipa3_replenish_rx_cache_recycle(struct ipa3_sys_context *sys)
 			gsi_xfer_elem_one.addr = rx_pkt->data.dma_addr;
 			gsi_xfer_elem_one.len = sys->rx_buff_sz;
 			gsi_xfer_elem_one.flags |= GSI_XFER_FLAG_EOT;
+			gsi_xfer_elem_one.flags |= GSI_XFER_FLAG_EOB;
 			gsi_xfer_elem_one.type = GSI_XFER_ELEM_DATA;
 			gsi_xfer_elem_one.xfer_user_data = rx_pkt;
 
@@ -2272,6 +2275,7 @@ static void ipa3_fast_replenish_rx_cache(struct ipa3_sys_context *sys)
 			gsi_xfer_elem_one.addr = rx_pkt->data.dma_addr;
 			gsi_xfer_elem_one.len = sys->rx_buff_sz;
 			gsi_xfer_elem_one.flags |= GSI_XFER_FLAG_EOT;
+			gsi_xfer_elem_one.flags |= GSI_XFER_FLAG_EOB;
 			gsi_xfer_elem_one.type = GSI_XFER_ELEM_DATA;
 			gsi_xfer_elem_one.xfer_user_data = rx_pkt;
 
@@ -2407,7 +2411,6 @@ static int ipa3_lan_rx_pyld_hdlr(struct sk_buff *skb,
 
 	if (skb->len == 0) {
 		IPAERR("ZLT\n");
-		sys->free_skb(skb);
 		return rc;
 	}
 
@@ -2467,7 +2470,6 @@ static int ipa3_lan_rx_pyld_hdlr(struct sk_buff *skb,
 				sys->prev_skb = skb2;
 			}
 			sys->len_rem -= skb->len;
-			sys->free_skb(skb);
 			return rc;
 		}
 	}
@@ -2481,7 +2483,7 @@ begin:
 		if (skb->len < pkt_status_sz) {
 			WARN_ON(sys->prev_skb != NULL);
 			IPADBG_LOW("status straddles buffer\n");
-			sys->prev_skb = skb;
+			sys->prev_skb = skb_copy(skb, GFP_KERNEL);
 			sys->len_partial = skb->len;
 			return rc;
 		}
@@ -2573,7 +2575,7 @@ begin:
 				IPAHAL_PKT_STATUS_EXCEPTION_NONE) {
 				WARN_ON(sys->prev_skb != NULL);
 				IPADBG_LOW("Ins header in next buffer\n");
-				sys->prev_skb = skb;
+				sys->prev_skb = skb_copy(skb, GFP_KERNEL);
 				sys->len_partial = skb->len;
 				return rc;
 			}
@@ -2594,7 +2596,7 @@ begin:
 			}
 
 			skb2 = ipa3_skb_copy_for_client(skb,
-				status.pkt_len + pkt_status_sz);
+				min(status.pkt_len + pkt_status_sz, skb->len));
 			if (likely(skb2)) {
 				if (skb->len < len + pkt_status_sz) {
 					IPADBG_LOW("SPL skb len %d len %d\n",
@@ -3764,6 +3766,7 @@ static void ipa_gsi_irq_rx_notify_cb(struct gsi_chan_xfer_notify *notify)
 
 	switch (notify->evt_id) {
 	case GSI_CHAN_EVT_EOT:
+	case GSI_CHAN_EVT_EOB:
 		atomic_set(&ipa3_ctx->transport_pm.eot_activity, 1);
 		if (!atomic_read(&sys->curr_polling_state)) {
 			/* put the gsi channel into polling mode */