diff --git a/[refs] b/[refs]
index 908e9c0f7ed4..9c900e7b7e1c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: da3ba88a9996cd64c6768bed5727e02da81e2c8d
+refs/heads/master: 6f2d93353a48af4d5b6ea2a79994d7c9a94b356a
diff --git a/trunk/net/mac80211/iface.c b/trunk/net/mac80211/iface.c
index eaa80a3d412b..4116a7542b6b 100644
--- a/trunk/net/mac80211/iface.c
+++ b/trunk/net/mac80211/iface.c
@@ -460,17 +460,15 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 		synchronize_rcu();
 		kfree(old_beacon);
 
-		/* free all potentially still buffered bcast frames */
-		while ((skb = skb_dequeue(&sdata->u.ap.ps_bc_buf))) {
-			local->total_ps_buffered--;
-			dev_kfree_skb(skb);
-		}
-
 		/* down all dependent devices, that is VLANs */
 		list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
 					 u.vlan.list)
 			dev_close(vlan->dev);
 		WARN_ON(!list_empty(&sdata->u.ap.vlans));
+
+		/* free all potentially still buffered bcast frames */
+		local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps_bc_buf);
+		skb_queue_purge(&sdata->u.ap.ps_bc_buf);
 	}
 
 	if (going_down)