1 files changed, 6 insertions, 2 deletions

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index a48bad468880..7702978a4c99 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
                 container_of(h, struct tid_ampdu_rx, rcu_head);
         int i;
 
-        del_timer_sync(&tid_rx->reorder_timer);
-
         for (i = 0; i < tid_rx->buf_size; i++)
                 __skb_queue_purge(&tid_rx->reorder_buf[i]);
         kfree(tid_rx->reorder_buf);
@@ -93,6 +91,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 
         del_timer_sync(&tid_rx->session_timer);
 
+        /* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
+        spin_lock_bh(&tid_rx->reorder_lock);
+        tid_rx->removed = true;
+        spin_unlock_bh(&tid_rx->reorder_lock);
+        del_timer_sync(&tid_rx->reorder_timer);
+
         call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }