diff --git a/[refs] b/[refs]
index af11bfce7edf..5f4d646819a5 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 3e41ace5deef7af16dd277d9d17f9d36dca0a10e
+refs/heads/master: 7b21f00ee6073909c01adeba317af3d78c3b9d0a
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-tx.c b/trunk/drivers/net/wireless/iwlwifi/iwl-tx.c
index e7faba57b6e3..1b69507db5fc 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -470,6 +470,14 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
 		return -EIO;
 	}
 
+	/*
+	 * As we only have a single huge buffer, check that the command
+	 * is synchronous (otherwise buffers could end up being reused).
+	 */
+
+	if (WARN_ON((cmd->flags & CMD_ASYNC) && (cmd->flags & CMD_SIZE_HUGE)))
+		return -EINVAL;
+
 	spin_lock_irqsave(&priv->hcmd_lock, flags);
 
 	if (iwl_queue_space(q) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) {