diff --git a/src/gprs_ms.c b/src/gprs_ms.c
index 4cab8e4..d9e52ea 100644
--- a/src/gprs_ms.c
+++ b/src/gprs_ms.c
@@ -409,7 +409,7 @@
 	if (tbf && !tbf_timers_pending(tbf, T_MAX))
 		tbf_free(tbf);
 
-	llist_for_each_entry(pos, &ms->old_tbfs, list) {
+	while ((pos = llist_first_entry_or_null(&ms->old_tbfs, struct llist_item, list))) {
 		tbf = (struct gprs_rlcmac_tbf *)pos->entry;
 		if (!tbf_timers_pending(tbf, T_MAX))
 			tbf_free(tbf);