diff --git a/[refs] b/[refs]
index 2fc1386f5d65..c0bcc3a96c67 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 735761108f435a30bbabb5254fc5a8e17b99f2a1
+refs/heads/master: 2c7808d9345b91bb19f6bfaebf7b9e0916b0859a
diff --git a/trunk/drivers/net/wireless/ath/carl9170/main.c b/trunk/drivers/net/wireless/ath/carl9170/main.c
index ea49d54ce03b..43de9dfa5820 100644
--- a/trunk/drivers/net/wireless/ath/carl9170/main.c
+++ b/trunk/drivers/net/wireless/ath/carl9170/main.c
@@ -1412,7 +1412,7 @@ static void carl9170_op_sta_notify(struct ieee80211_hw *hw,
 {
 	struct ar9170 *ar = hw->priv;
 	struct carl9170_sta_info *sta_info = (void *) sta->drv_priv;
-	struct sk_buff *skb;
+	struct sk_buff *skb, *tmp;
 	struct sk_buff_head free;
 	int i;
 
@@ -1462,7 +1462,7 @@ static void carl9170_op_sta_notify(struct ieee80211_hw *hw,
 
 		for (i = 0; i < ar->hw->queues; i++) {
 			spin_lock_bh(&ar->tx_pending[i].lock);
-			skb_queue_walk(&ar->tx_pending[i], skb) {
+			skb_queue_walk_safe(&ar->tx_pending[i], skb, tmp) {
 				struct _carl9170_tx_superframe *super;
 				struct ieee80211_hdr *hdr;