1 files changed, 14 insertions, 3 deletions

diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 35b515fe3ffa..5ac713d2ff5d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -399,6 +399,7 @@ static struct ath_buf* ath_clone_txbuf(struct ath_softc *sc, struct ath_buf *bf)
         tbf->bf_buf_addr = bf->bf_buf_addr;
         memcpy(tbf->bf_desc, bf->bf_desc, sc->sc_ah->caps.tx_desc_len);
         tbf->bf_state = bf->bf_state;
+        tbf->bf_state.stale = false;
 
         return tbf;
 }
@@ -1389,11 +1390,15 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
                       u16 tid, u16 *ssn)
 {
         struct ath_atx_tid *txtid;
+        struct ath_txq *txq;
         struct ath_node *an;
         u8 density;
 
         an = (struct ath_node *)sta->drv_priv;
         txtid = ATH_AN_2_TID(an, tid);
+        txq = txtid->ac->txq;
+
+        ath_txq_lock(sc, txq);
 
         /* update ampdu factor/density, they may have changed. This may happen
          * in HT IBSS when a beacon with HT-info is received after the station
@@ -1417,6 +1422,8 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
         memset(txtid->tx_buf, 0, sizeof(txtid->tx_buf));
         txtid->baw_head = txtid->baw_tail = 0;
 
+        ath_txq_unlock_complete(sc, txq);
+
         return 0;
 }
 
@@ -1555,8 +1562,10 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
                         __skb_unlink(bf->bf_mpdu, tid_q);
                         list_add_tail(&bf->list, &bf_q);
                         ath_set_rates(tid->an->vif, tid->an->sta, bf);
-                        ath_tx_addto_baw(sc, tid, bf);
-                        bf->bf_state.bf_type &= ~BUF_AGGR;
+                        if (bf_isampdu(bf)) {
+                                ath_tx_addto_baw(sc, tid, bf);
+                                bf->bf_state.bf_type &= ~BUF_AGGR;
+                        }
                         if (bf_tail)
                                 bf_tail->bf_next = bf;
 
@@ -1950,7 +1959,9 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
                         if (bf_is_ampdu_not_probing(bf))
                                 txq->axq_ampdu_depth++;
 
-                        bf = bf->bf_lastbf->bf_next;
+                        bf_last = bf->bf_lastbf;
+                        bf = bf_last->bf_next;
+                        bf_last->bf_next = NULL;
                 }
         }
 }