diff --git a/kernel.spec b/kernel.spec
index be5fcc0ad..9286d8014 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -709,6 +709,8 @@ Patch12411: mm-vmstat-use-a-single-setter-function-and-callback-for-adjusting-pe
 # rhbz#650934
 Patch12420: sched-cure-more-NO_HZ-load-average-woes.patch
 
+Patch12421: orinoco-initialise-priv_hw-before-assigning-the-interrupt.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1305,6 +1307,12 @@ ApplyPatch debug-tty-print-dev-name.patch
 ApplyPatch mm-page-allocator-adjust-the-per-cpu-counter-threshold-when-memory-is-low.patch
 ApplyPatch mm-vmstat-use-a-single-setter-function-and-callback-for-adjusting-percpu-thresholds.patch
 
+# rhbz#650934
+ApplyPatch sched-cure-more-NO_HZ-load-average-woes.patch
+
+# rhbz657864
+ApplyPatch orinoco-initialise-priv_hw-before-assigning-the-interrupt.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -1918,6 +1926,11 @@ fi
 #                 ||     ||
 
 %changelog
+* Thu Dec 09 2010 Kyle McMartin <kyle@redhat.com>
+- Snarf patch from wireless-next to fix mdomsch's orinico wifi.
+  (orinoco: initialise priv->hw before assigning the interrupt)
+  [229bd792] (#657864)
+
 * Wed Dec 08 2010 Kyle McMartin <kyle@redhat.com> 2.6.37-0.rc5.git2.1
 - Linux 2.6.37-rc5-git2
 - sched-cure-more-NO_HZ-load-average-woes.patch: fix some of the complaints
diff --git a/orinoco-initialise-priv_hw-before-assigning-the-interrupt.patch b/orinoco-initialise-priv_hw-before-assigning-the-interrupt.patch
new file mode 100644
index 000000000..7461d29a3
--- /dev/null
+++ b/orinoco-initialise-priv_hw-before-assigning-the-interrupt.patch
@@ -0,0 +1,91 @@
+From 17f1e34b178ffc0111d768f48a86b58fd0c88c56 Mon Sep 17 00:00:00 2001
+From: David Kilroy <kilroyd@googlemail.com>
+Date: Tue, 7 Dec 2010 18:50:42 +0000
+Subject: [PATCH] orinoco: initialise priv->hw before assigning the interrupt
+
+The interrupt handler takes a lock - but since commit bcad6e80f3f this
+lock goes through an indirection specified in the hermes_t structure.
+We must therefore initialise the structure before setting up the
+interrupt handler.
+
+Fix orinoco_cs and spectrum_cs
+
+<https://bugzilla.kernel.org/show_bug.cgi?id=23932>
+
+Bisected by: Matt Domsch <Matt_Domsch@dell.com>
+Signed-off by: David Kilroy <kilroyd@googlemail.com>
+Cc: stable@kernel.org
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+---
+ drivers/net/wireless/orinoco/orinoco_cs.c  |   14 +++++++-------
+ drivers/net/wireless/orinoco/spectrum_cs.c |   14 +++++++-------
+ 2 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
+index 71b3d68..32954c4 100644
+--- a/drivers/net/wireless/orinoco/orinoco_cs.c
++++ b/drivers/net/wireless/orinoco/orinoco_cs.c
+@@ -151,20 +151,20 @@ orinoco_cs_config(struct pcmcia_device *link)
+ 		goto failed;
+ 	}
+ 
+-	ret = pcmcia_request_irq(link, orinoco_interrupt);
+-	if (ret)
+-		goto failed;
+-
+-	/* We initialize the hermes structure before completing PCMCIA
+-	 * configuration just in case the interrupt handler gets
+-	 * called. */
+ 	mem = ioport_map(link->resource[0]->start,
+ 			resource_size(link->resource[0]));
+ 	if (!mem)
+ 		goto failed;
+ 
++	/* We initialize the hermes structure before completing PCMCIA
++	 * configuration just in case the interrupt handler gets
++	 * called. */
+ 	hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
+ 
++	ret = pcmcia_request_irq(link, orinoco_interrupt);
++	if (ret)
++		goto failed;
++
+ 	ret = pcmcia_enable_device(link);
+ 	if (ret)
+ 		goto failed;
+diff --git a/drivers/net/wireless/orinoco/spectrum_cs.c b/drivers/net/wireless/orinoco/spectrum_cs.c
+index fb859a5..db34c28 100644
+--- a/drivers/net/wireless/orinoco/spectrum_cs.c
++++ b/drivers/net/wireless/orinoco/spectrum_cs.c
+@@ -214,21 +214,21 @@ spectrum_cs_config(struct pcmcia_device *link)
+ 		goto failed;
+ 	}
+ 
+-	ret = pcmcia_request_irq(link, orinoco_interrupt);
+-	if (ret)
+-		goto failed;
+-
+-	/* We initialize the hermes structure before completing PCMCIA
+-	 * configuration just in case the interrupt handler gets
+-	 * called. */
+ 	mem = ioport_map(link->resource[0]->start,
+ 			resource_size(link->resource[0]));
+ 	if (!mem)
+ 		goto failed;
+ 
++	/* We initialize the hermes structure before completing PCMCIA
++	 * configuration just in case the interrupt handler gets
++	 * called. */
+ 	hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
+ 	hw->eeprom_pda = true;
+ 
++	ret = pcmcia_request_irq(link, orinoco_interrupt);
++	if (ret)
++		goto failed;
++
+ 	ret = pcmcia_enable_device(link);
+ 	if (ret)
+ 		goto failed;
+-- 
+1.7.3.3
+