diff --git a/[refs] b/[refs]
index 2d585451da00..a908bd72d605 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 4e808a38fdcaeeeddbc05942623279ebe7c02373
+refs/heads/master: d72308bff5c2fa207949a5925b020bce74495e33
diff --git a/trunk/net/mac80211/agg-rx.c b/trunk/net/mac80211/agg-rx.c
index 1068f668ac4e..64d3ce5ea1a0 100644
--- a/trunk/net/mac80211/agg-rx.c
+++ b/trunk/net/mac80211/agg-rx.c
@@ -49,6 +49,8 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
 		container_of(h, struct tid_ampdu_rx, rcu_head);
 	int i;
 
+	del_timer_sync(&tid_rx->reorder_timer);
+
 	for (i = 0; i < tid_rx->buf_size; i++)
 		dev_kfree_skb(tid_rx->reorder_buf[i]);
 	kfree(tid_rx->reorder_buf);
@@ -91,7 +93,6 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 				     tid, WLAN_BACK_RECIPIENT, reason);
 
 	del_timer_sync(&tid_rx->session_timer);
-	del_timer_sync(&tid_rx->reorder_timer);
 
 	call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }