--- y/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ h/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -711,6 +711,7 @@ static void ath9k_hif_usb_reg_in_cb(stru
 	struct sk_buff *skb = rx_buf->skb;
 	struct sk_buff *nskb;
 	int ret;
+	bool freed = false;
 
 	if (!skb)
 		return;
@@ -739,8 +740,7 @@ static void ath9k_hif_usb_reg_in_cb(stru
 		/* Process the command first */
 		ath9k_htc_rx_msg(hif_dev->htc_handle, skb,
 				 skb->len, USB_REG_IN_PIPE);
-
-
+		freed = true;
 		nskb = alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_ATOMIC);
 		if (!nskb) {
 			dev_err(&hif_dev->udev->dev,
@@ -768,7 +768,8 @@ resubmit:
 
 	return;
 free:
-	kfree_skb(skb);
+	if (!freed)
+		kfree_skb(skb);
 	kfree(rx_buf);
 	urb->context = NULL;
 }