3 files changed, 14 insertions, 3 deletions

diff --git a/drivers/net/wireless/wl12xx/main.c b/drivers/net/wireless/wl12xx/main.c
index 1127a3ee36e3..45cd10ab3aac 100644
--- a/drivers/net/wireless/wl12xx/main.c
+++ b/drivers/net/wireless/wl12xx/main.c
@@ -3757,11 +3757,14 @@ static int wl1271_allocate_sta(struct wl1271 *wl,
         return 0;
 }
 
-static void wl1271_free_sta(struct wl1271 *wl, u8 hlid)
+void wl1271_free_sta(struct wl1271 *wl, u8 hlid)
 {
         int id = hlid - WL1271_AP_STA_HLID_START;
 
-        if (WARN_ON(!test_bit(id, wl->ap_hlid_map)))
+        if (hlid < WL1271_AP_STA_HLID_START)
+                return;
+
+        if (!test_bit(id, wl->ap_hlid_map))
                 return;
 
         clear_bit(id, wl->ap_hlid_map);
diff --git a/drivers/net/wireless/wl12xx/tx.c b/drivers/net/wireless/wl12xx/tx.c
index 2bf31302b975..9d4157ce0950 100644
--- a/drivers/net/wireless/wl12xx/tx.c
+++ b/drivers/net/wireless/wl12xx/tx.c
@@ -891,6 +891,7 @@ void wl1271_tx_reset(struct wl1271 *wl, bool reset_tx_queues)
         /* TX failure */
         if (wl->bss_type == BSS_TYPE_AP_BSS) {
                 for (i = 0; i < AP_MAX_LINKS; i++) {
+                        wl1271_free_sta(wl, i);
                         wl1271_tx_reset_link_queues(wl, i);
                         wl->links[i].allocated_pkts = 0;
                         wl->links[i].prev_freed_pkts = 0;
@@ -910,10 +911,14 @@ void wl1271_tx_reset(struct wl1271 *wl, bool reset_tx_queues)
                                         ieee80211_tx_status_ni(wl->hw, skb);
                                 }
                         }
-                        wl->tx_queue_count[i] = 0;
                 }
+
+                wl->ba_rx_bitmap = 0;
         }
 
+        for (i = 0; i < NUM_TX_QUEUES; i++)
+                wl->tx_queue_count[i] = 0;
+
         wl->stopped_queues_map = 0;
 
         /*
diff --git a/drivers/net/wireless/wl12xx/tx.h b/drivers/net/wireless/wl12xx/tx.h
index 5c0fbbe5b42f..d6fdbf904a09 100644
--- a/drivers/net/wireless/wl12xx/tx.h
+++ b/drivers/net/wireless/wl12xx/tx.h
@@ -216,4 +216,7 @@ void wl1271_tx_reset_link_queues(struct wl1271 *wl, u8 hlid);
 void wl1271_handle_tx_low_watermark(struct wl1271 *wl);
 bool wl12xx_is_dummy_packet(struct wl1271 *wl, struct sk_buff *skb);
 
+/* from main.c */
+void wl1271_free_sta(struct wl1271 *wl, u8 hlid);
+
 #endif