4 files changed, 15 insertions, 14 deletions

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 9f2534a41243..e973a8f96c9b 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -965,9 +965,9 @@ struct ieee80211_local {
         int scan_channel_idx;
         int scan_ies_len;
 
-        bool sched_scanning;
         struct ieee80211_sched_scan_ies sched_scan_ies;
         struct work_struct sched_scan_stopped_work;
+        struct ieee80211_sub_if_data __rcu *sched_scan_sdata;
 
         unsigned long leave_oper_channel_time;
         enum mac80211_scan_state next_scan_state;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index c794101f8987..c26e231c733a 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -322,7 +322,8 @@ static void ieee80211_restart_work(struct work_struct *work)
 
         mutex_lock(&local->mtx);
         WARN(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
-             local->sched_scanning,
+             rcu_dereference_protected(local->sched_scan_sdata,
+                                       lockdep_is_held(&local->mtx)),
                 "%s called with hardware scan in progress\n", __func__);
         mutex_unlock(&local->mtx);
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index f8cf9e7477a3..17a56151be7f 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -421,13 +421,13 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
         struct sk_buff *skb = rx->skb;
 
         if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
-                   !local->sched_scanning))
+                   !rcu_access_pointer(local->sched_scan_sdata)))
                 return RX_CONTINUE;
 
         if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
             test_bit(SCAN_SW_SCANNING, &local->scanning) ||
             test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning) ||
-            local->sched_scanning)
+            rcu_access_pointer(local->sched_scan_sdata))
                 return ieee80211_scan_rx(rx->sdata, skb);
 
         /* scanning finished during invoking of handlers */
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 704dcf847761..a619c1ea9bd5 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -930,9 +930,9 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         int ret, i;
 
-        mutex_lock(&sdata->local->mtx);
+        mutex_lock(&local->mtx);
 
-        if (local->sched_scanning) {
+        if (rcu_access_pointer(local->sched_scan_sdata)) {
                 ret = -EBUSY;
                 goto out;
         }
@@ -966,7 +966,7 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
         ret = drv_sched_scan_start(local, sdata, req,
                                    &local->sched_scan_ies);
         if (ret == 0) {
-                local->sched_scanning = true;
+                rcu_assign_pointer(local->sched_scan_sdata, sdata);
                 goto out;
         }
 
@@ -974,7 +974,7 @@ out_free:
         while (i > 0)
                 kfree(local->sched_scan_ies.ie[--i]);
 out:
-        mutex_unlock(&sdata->local->mtx);
+        mutex_unlock(&local->mtx);
         return ret;
 }
 
@@ -983,22 +983,22 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
         int ret = 0, i;
 
-        mutex_lock(&sdata->local->mtx);
+        mutex_lock(&local->mtx);
 
         if (!local->ops->sched_scan_stop) {
                 ret = -ENOTSUPP;
                 goto out;
         }
 
-        if (local->sched_scanning) {
+        if (rcu_access_pointer(local->sched_scan_sdata)) {
                 for (i = 0; i < IEEE80211_NUM_BANDS; i++)
                         kfree(local->sched_scan_ies.ie[i]);
 
                 drv_sched_scan_stop(local, sdata);
-                local->sched_scanning = false;
+                rcu_assign_pointer(local->sched_scan_sdata, NULL);
         }
 out:
-        mutex_unlock(&sdata->local->mtx);
+        mutex_unlock(&local->mtx);
 
         return ret;
 }
@@ -1022,7 +1022,7 @@ void ieee80211_sched_scan_stopped_work(struct work_struct *work)
 
         mutex_lock(&local->mtx);
 
-        if (!local->sched_scanning) {
+        if (!rcu_access_pointer(local->sched_scan_sdata)) {
                 mutex_unlock(&local->mtx);
                 return;
         }
@@ -1030,7 +1030,7 @@ void ieee80211_sched_scan_stopped_work(struct work_struct *work)
         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
                 kfree(local->sched_scan_ies.ie[i]);
 
-        local->sched_scanning = false;
+        rcu_assign_pointer(local->sched_scan_sdata, NULL);
 
         mutex_unlock(&local->mtx);