1 files changed, 11 insertions, 1 deletions

diff --git a/drivers/net/wireless/ath/wil6210/rx_reorder.c b/drivers/net/wireless/ath/wil6210/rx_reorder.c
index e3d1be82f314..32031e7a11d5 100644
--- a/drivers/net/wireless/ath/wil6210/rx_reorder.c
+++ b/drivers/net/wireless/ath/wil6210/rx_reorder.c
@@ -261,9 +261,19 @@ struct wil_tid_ampdu_rx *wil_tid_ampdu_rx_alloc(struct wil6210_priv *wil,
 void wil_tid_ampdu_rx_free(struct wil6210_priv *wil,
                            struct wil_tid_ampdu_rx *r)
 {
+        int i;
+
         if (!r)
                 return;
-        wil_release_reorder_frames(wil, r, r->head_seq_num + r->buf_size);
+
+        /* Do not pass remaining frames to the network stack - it may be
+         * not expecting to get any more Rx. Rx from here may lead to
+         * kernel OOPS since some per-socket accounting info was already
+         * released.
+         */
+        for (i = 0; i < r->buf_size; i++)
+                kfree_skb(r->reorder_buf[i]);
+
         kfree(r->reorder_buf);
         kfree(r->reorder_time);
         kfree(r);