1 files changed, 23 insertions, 5 deletions

diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index b04162f10d85..83a1c1b1d6cd 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -23,7 +23,6 @@ Author: Marcell GAL, 2000, XDSL Ltd, Hungary
 #include <linux/atmbr2684.h>
 
 #include "common.h"
-#include "ipcommon.h"
 
 /*
  * Define this to use a version of the code which interacts with the higher
@@ -500,11 +499,12 @@ Note: we do not have explicit unassign, but look at _push()
 */
         int err;
         struct br2684_vcc *brvcc;
-        struct sk_buff_head copy;
         struct sk_buff *skb;
+        struct sk_buff_head *rq;
         struct br2684_dev *brdev;
         struct net_device *net_dev;
         struct atm_backend_br2684 be;
+        unsigned long flags;
 
         if (copy_from_user(&be, arg, sizeof be))
                 return -EFAULT;
@@ -554,12 +554,30 @@ Note: we do not have explicit unassign, but look at _push()
         brvcc->old_push = atmvcc->push;
         barrier();
         atmvcc->push = br2684_push;
-        skb_queue_head_init(&copy);
-        skb_migrate(&sk_atm(atmvcc)->sk_receive_queue, &copy);
-        while ((skb = skb_dequeue(&copy)) != NULL) {
+
+        rq = &sk_atm(atmvcc)->sk_receive_queue;
+
+        spin_lock_irqsave(&rq->lock, flags);
+        if (skb_queue_empty(rq)) {
+                skb = NULL;
+        } else {
+                /* NULL terminate the list.  */
+                rq->prev->next = NULL;
+                skb = rq->next;
+        }
+        rq->prev = rq->next = (struct sk_buff *)rq;
+        rq->qlen = 0;
+        spin_unlock_irqrestore(&rq->lock, flags);
+
+        while (skb) {
+                struct sk_buff *next = skb->next;
+
+                skb->next = skb->prev = NULL;
                 BRPRIV(skb->dev)->stats.rx_bytes -= skb->len;
                 BRPRIV(skb->dev)->stats.rx_packets--;
                 br2684_push(atmvcc, skb);
+
+                skb = next;
         }
         __module_get(THIS_MODULE);
         return 0;