CALL_TXH(ieee80211_tx_h_ps_buf);
        CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
        CALL_TXH(ieee80211_tx_h_select_key);
-       if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
-               CALL_TXH(ieee80211_tx_h_rate_ctrl);
 
  txh_done:
        if (unlikely(res == TX_DROP)) {
                goto txh_done;
        }
 
+       if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
+               CALL_TXH(ieee80211_tx_h_rate_ctrl);
+
        CALL_TXH(ieee80211_tx_h_michael_mic_add);
        CALL_TXH(ieee80211_tx_h_sequence);
        CALL_TXH(ieee80211_tx_h_fragment);
  * Can be called while the sta lock is held. Anything that can cause packets to
  * be generated will cause deadlock!
  */
-static void ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data *sdata,
-                                      struct sta_info *sta, u8 pn_offs,
-                                      struct ieee80211_key *key,
-                                      struct sk_buff *skb)
+static ieee80211_tx_result
+ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data *sdata,
+                          struct sta_info *sta, u8 pn_offs,
+                          struct ieee80211_key *key,
+                          struct ieee80211_tx_data *tx)
 {
+       struct sk_buff *skb = tx->skb;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        struct ieee80211_hdr *hdr = (void *)skb->data;
        u8 tid = IEEE80211_NUM_TIDS;
 
+       if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL) &&
+           ieee80211_tx_h_rate_ctrl(tx) != TX_CONTINUE)
+               return TX_DROP;
+
        if (key)
                info->control.hw_key = &key->conf;
 
                        break;
                }
        }
+
+       return TX_CONTINUE;
 }
 
 static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
        tx.sta = sta;
        tx.key = fast_tx->key;
 
-       if (!ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
-               tx.skb = skb;
-               r = ieee80211_tx_h_rate_ctrl(&tx);
-               skb = tx.skb;
-               tx.skb = NULL;
-
-               if (r != TX_CONTINUE) {
-                       if (r != TX_QUEUED)
-                               kfree_skb(skb);
-                       return true;
-               }
-       }
-
        if (ieee80211_queue_skb(local, sdata, sta, skb))
                return true;
 
-       ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
-                                  fast_tx->key, skb);
+       tx.skb = skb;
+       r = ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
+                                      fast_tx->key, &tx);
+       tx.skb = NULL;
+       if (r == TX_DROP) {
+               kfree_skb(skb);
+               return true;
+       }
 
        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                sdata = container_of(sdata->bss,
                    (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
                        pn_offs = ieee80211_hdrlen(hdr->frame_control);
 
-               ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
-                                          tx.key, skb);
+               r = ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
+                                              tx.key, &tx);
+               if (r != TX_CONTINUE) {
+                       ieee80211_free_txskb(&local->hw, skb);
+                       goto begin;
+               }
        } else {
                if (invoke_tx_handlers_late(&tx))
                        goto begin;