4 files changed, 17 insertions, 4 deletions

diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 7f6c58ebbc44..1142d85ea881 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1522,6 +1522,8 @@ static void __iwl_down(struct iwl_priv *priv)
         if (priv->shrd->mac80211_registered)
                 ieee80211_stop_queues(priv->hw);
 
+        iwl_trans_stop_device(trans(priv));
+
         /* Clear out all status bits but a few that are stable across reset */
         priv->shrd->status &=
                         test_bit(STATUS_RF_KILL_HW, &priv->shrd->status) <<
@@ -1533,8 +1535,6 @@ static void __iwl_down(struct iwl_priv *priv)
                         test_bit(STATUS_EXIT_PENDING, &priv->shrd->status) <<
                                 STATUS_EXIT_PENDING;
 
-        iwl_trans_stop_device(trans(priv));
-
         dev_kfree_skb(priv->beacon_skb);
         priv->beacon_skb = NULL;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 9270f990b2dd..5e490dbe0d07 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1876,3 +1876,12 @@ void iwl_nic_config(struct iwl_priv *priv)
         priv->cfg->lib->nic_config(priv);
 
 }
+
+void iwl_free_skb(struct iwl_priv *priv, struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *info;
+
+        info = IEEE80211_SKB_CB(skb);
+        kmem_cache_free(priv->tx_cmd_pool, (info->driver_data[1]));
+        dev_kfree_skb_any(skb);
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-shared.h b/drivers/net/wireless/iwlwifi/iwl-shared.h
index d987bee5e6ce..bdfbc6058ba1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-shared.h
+++ b/drivers/net/wireless/iwlwifi/iwl-shared.h
@@ -390,6 +390,7 @@ void iwl_stop_tx_ba_trans_ready(struct iwl_priv *priv,
                                 u8 sta_id, u8 tid);
 void iwl_set_hw_rfkill_state(struct iwl_priv *priv, bool state);
 void iwl_nic_config(struct iwl_priv *priv);
+void iwl_free_skb(struct iwl_priv *priv, struct sk_buff *skb);
 void iwl_apm_stop(struct iwl_priv *priv);
 int iwl_apm_init(struct iwl_priv *priv);
 void iwlagn_fw_error(struct iwl_priv *priv, bool ondemand);
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
index c7ddb2204a6e..15cb0ff2ff18 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
@@ -225,9 +225,12 @@ void iwlagn_txq_free_tfd(struct iwl_trans *trans, struct iwl_tx_queue *txq,
 
                 skb = txq->skbs[index];
 
-                /* can be called from irqs-disabled context */
+                /* Can be called from irqs-disabled context
+                 * If skb is not NULL, it means that the whole queue is being
+                 * freed and that the queue is not empty - free the skb
+                 */
                 if (skb) {
-                        dev_kfree_skb_any(skb);
+                        iwl_free_skb(priv(trans), skb);
                         txq->skbs[index] = NULL;
                 }
         }