kfree_rcu(old_probe_resp, rcu_head);
 
        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
-               sta_info_flush(vlan);
-       sta_info_flush(sdata);
+               sta_info_flush_defer(vlan);
+       sta_info_flush_defer(sdata);
+       rcu_barrier();
+       list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+               sta_info_flush_cleanup(vlan);
+       sta_info_flush_cleanup(sdata);
+
        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
 
        drv_stop_ap(sdata->local, sdata);
 
                cancel_work_sync(&sdata->work);
                /*
                 * When we get here, the interface is marked down.
-                * sta_info_flush_cleanup() calls rcu_barrier to
-                * wait for the station call_rcu() calls to complete,
-                * here we require it to wait for the RX path in case
-                * it is using the interface and enqueuing frames at
-                * this very time on another CPU.
+                *
+                * sta_info_flush_cleanup() requires rcu_barrier()
+                * first to wait for the station call_rcu() calls
+                * to complete, here we need at least sychronize_rcu()
+                * it to wait for the RX path in case it is using the
+                * interface and enqueuing frames at this very time on
+                * another CPU.
                 */
+               rcu_barrier();
                sta_info_flush_cleanup(sdata);
 
                skb_queue_purge(&sdata->skb_queue);
 
 
 void sta_info_flush_cleanup(struct ieee80211_sub_if_data *sdata)
 {
-       rcu_barrier();
-
        ieee80211_cleanup_sdata_stas(sdata);
        cancel_work_sync(&sdata->cleanup_stations_wk);
 }
 
 void sta_info_init(struct ieee80211_local *local);
 void sta_info_stop(struct ieee80211_local *local);
 int sta_info_flush_defer(struct ieee80211_sub_if_data *sdata);
+
+/**
+ * sta_info_flush_cleanup - flush the sta_info cleanup queue
+ * @sdata: the interface
+ *
+ * Flushes the sta_info cleanup queue for a given interface;
+ * this is necessary before the interface is removed or, for
+ * AP/mesh interfaces, before it is deconfigured.
+ *
+ * Note an rcu_barrier() must precede the function, after all
+ * stations have been flushed/removed to ensure the call_rcu()
+ * calls that add stations to the cleanup queue have completed.
+ */
 void sta_info_flush_cleanup(struct ieee80211_sub_if_data *sdata);
 
 /**
 {
        int ret = sta_info_flush_defer(sdata);
 
+       rcu_barrier();
        sta_info_flush_cleanup(sdata);
 
        return ret;