In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
However Artur Skawina <art.08.09@gmail.com> has shown that it can happen in reverse order as well.
This is very bad and could lead to memory corruptions, oopses and panics.

Thanks to Artur Skawina <art.08.09@gmail.com> for reporting and debugging this issue.
Signed-off-by: NChristian Lamparter <chunkeey@web.de>
Tested-by: NArtur Skawina <art.08.09@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>