1 files changed, 6 insertions, 3 deletions

diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index fcf43bcae979..14438a642fdd 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -849,10 +849,11 @@ static struct sk_buff *p54_find_tx_entry(struct ieee80211_hw *dev,
                                            __le32 req_id)
 {
         struct p54_common *priv = dev->priv;
-        struct sk_buff *entry = priv->tx_queue.next;
+        struct sk_buff *entry;
         unsigned long flags;
 
         spin_lock_irqsave(&priv->tx_queue.lock, flags);
+        entry = priv->tx_queue.next;
         while (entry != (struct sk_buff *)&priv->tx_queue) {
                 struct p54_hdr *hdr = (struct p54_hdr *) entry->data;
 
@@ -871,7 +872,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
         struct p54_common *priv = dev->priv;
         struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
         struct p54_frame_sent *payload = (struct p54_frame_sent *) hdr->data;
-        struct sk_buff *entry = (struct sk_buff *) priv->tx_queue.next;
+        struct sk_buff *entry;
         u32 addr = le32_to_cpu(hdr->req_id) - priv->headroom;
         struct p54_tx_info *range = NULL;
         u32 freed = 0;
@@ -880,6 +881,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
         int count, idx;
 
         spin_lock_irqsave(&priv->tx_queue.lock, flags);
+        entry = (struct sk_buff *) priv->tx_queue.next;
         while (entry != (struct sk_buff *)&priv->tx_queue) {
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
                 struct p54_hdr *entry_hdr;
@@ -1122,7 +1124,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
                                struct p54_hdr *data, u32 len)
 {
         struct p54_common *priv = dev->priv;
-        struct sk_buff *entry = priv->tx_queue.next;
+        struct sk_buff *entry;
         struct sk_buff *target_skb = NULL;
         struct ieee80211_tx_info *info;
         struct p54_tx_info *range;
@@ -1160,6 +1162,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
                 }
         }
 
+        entry = priv->tx_queue.next;
         while (left--) {
                 u32 hole_size;
                 info = IEEE80211_SKB_CB(entry);