1 files changed, 17 insertions, 7 deletions

diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 8150c5c3a16b..b90adcb73b06 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -239,26 +239,22 @@ void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
         struct iwl_rx_queue *rxq = &priv->rxq;
         struct list_head *element;
         struct iwl_rx_mem_buffer *rxb;
+        struct sk_buff *skb;
         unsigned long flags;
 
         while (1) {
                 spin_lock_irqsave(&rxq->lock, flags);
-
                 if (list_empty(&rxq->rx_used)) {
                         spin_unlock_irqrestore(&rxq->lock, flags);
                         return;
                 }
-                element = rxq->rx_used.next;
-                rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
-                list_del(element);
-
                 spin_unlock_irqrestore(&rxq->lock, flags);
 
                 /* Alloc a new receive buffer */
-                rxb->skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
+                skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
                                                 priority);
 
-                if (!rxb->skb) {
+                if (!skb) {
                         IWL_CRIT(priv, "Can not allocate SKB buffers\n");
                         /* We don't reschedule replenish work here -- we will
                          * call the restock method and if it still needs
@@ -266,6 +262,20 @@ void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                         break;
                 }
 
+                spin_lock_irqsave(&rxq->lock, flags);
+
+                if (list_empty(&rxq->rx_used)) {
+                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        dev_kfree_skb_any(skb);
+                        return;
+                }
+                element = rxq->rx_used.next;
+                rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+                list_del(element);
+
+                spin_unlock_irqrestore(&rxq->lock, flags);
+
+                rxb->skb = skb;
                 /* Get physical address of RB/SKB */
                 rxb->real_dma_addr = pci_map_single(
                                         priv->pci_dev,