This is a obvious bug, skb_queue_walk does not work if the iterator gets removed from the queue. Signed-off-by: Christian Lamparter <chunkeey@xxxxxxxxxxxxxx> --- drivers/net/wireless/ath/carl9170/main.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c index ea49d54..43de9df 100644 --- a/drivers/net/wireless/ath/carl9170/main.c +++ b/drivers/net/wireless/ath/carl9170/main.c @@ -1412,7 +1412,7 @@ static void carl9170_op_sta_notify(struct ieee80211_hw *hw, { struct ar9170 *ar = hw->priv; struct carl9170_sta_info *sta_info = (void *) sta->drv_priv; - struct sk_buff *skb; + struct sk_buff *skb, *tmp; struct sk_buff_head free; int i; @@ -1462,7 +1462,7 @@ static void carl9170_op_sta_notify(struct ieee80211_hw *hw, for (i = 0; i < ar->hw->queues; i++) { spin_lock_bh(&ar->tx_pending[i].lock); - skb_queue_walk(&ar->tx_pending[i], skb) { + skb_queue_walk_safe(&ar->tx_pending[i], skb, tmp) { struct _carl9170_tx_superframe *super; struct ieee80211_hdr *hdr; -- 1.7.1 -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html