2 files changed, 9 insertions, 2 deletions

diff --git a/drivers/net/wireless/wl12xx/main.c b/drivers/net/wireless/wl12xx/main.c
index 2f7bfa86c8c..333bc294f1d 100644
--- a/drivers/net/wireless/wl12xx/main.c
+++ b/drivers/net/wireless/wl12xx/main.c
@@ -1448,7 +1448,7 @@ static void wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (hlid == WL12XX_INVALID_LINK_ID ||
             (wlvif && !test_bit(hlid, wlvif->links_map))) {
                 wl1271_debug(DEBUG_TX, "DROP skb hlid %d q %d", hlid, q);
-                dev_kfree_skb(skb);
+                ieee80211_free_txskb(hw, skb);
                 goto out;
         }
 
diff --git a/drivers/net/wireless/wl12xx/tx.c b/drivers/net/wireless/wl12xx/tx.c
index 7d727ee6ddf..4508ccd7832 100644
--- a/drivers/net/wireless/wl12xx/tx.c
+++ b/drivers/net/wireless/wl12xx/tx.c
@@ -740,7 +740,14 @@ void wl1271_tx_work_locked(struct wl1271 *wl)
                         set_bit(WL1271_FLAG_FW_TX_BUSY, &wl->flags);
                         goto out_ack;
                 } else if (ret < 0) {
-                        dev_kfree_skb(skb);
+                        if (wl12xx_is_dummy_packet(wl, skb))
+                                /*
+                                 * fw still expects dummy packet,
+                                 * so re-enqueue it
+                                 */
+                                wl1271_skb_queue_head(wl, wlvif, skb);
+                        else
+                                ieee80211_free_txskb(wl->hw, skb);
                         goto out_ack;
                 }
                 buf_offset += ret;