diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2012-05-31 15:09:27 +0200 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2012-06-19 23:18:11 +0100 |
| commit | 68d214eda1a87c9045ab8c5247d1911cfc47bede (patch) | |
| tree | 40ccaa8108700829621f121cbad01a8b2e6f3f99 /net/mac80211/iface.c | |
| parent | c022fe20a36fa5c578a76b6c9a64b5d663f82f4b (diff) | |
mac80211: clean up remain-on-channel on interface stop
commit 71ecfa1893034eeb1c93e02e22ee2ad26d080858 upstream.
When any interface goes down, it could be the one that we
were doing a remain-on-channel with. We therefore need to
cancel the remain-on-channel and flush the related work
structs so they don't run after the interface has been
removed or even destroyed.
It's also possible in this case that an off-channel SKB
was never transmitted, so free it if this is the case.
Note that this can also happen if the driver finishes
the off-channel period without ever starting it.
Reported-by: Nirav Shah <nirav.j2.shah@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net/mac80211/iface.c')
| -rw-r--r-- | net/mac80211/iface.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index 30d73552e9a..f4ddf34c969 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -495,6 +495,18 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, ieee80211_configure_filter(local); break; default: + mutex_lock(&local->mtx); + if (local->hw_roc_dev == sdata->dev && + local->hw_roc_channel) { + /* ignore return value since this is racy */ + drv_cancel_remain_on_channel(local); + ieee80211_queue_work(&local->hw, &local->hw_roc_done); + } + mutex_unlock(&local->mtx); + + flush_work(&local->hw_roc_start); + flush_work(&local->hw_roc_done); + flush_work(&sdata->work); /* * When we get here, the interface is marked down. |