1 files changed, 16 insertions, 6 deletions

diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 1b1b2bf26819..4310cf102d78 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -1750,8 +1750,10 @@ static void iwl_mvm_query_netdetect_reasons(struct iwl_mvm *mvm,
         int i, j, n_matches, ret;
 
         fw_status = iwl_mvm_get_wakeup_status(mvm, vif);
-        if (!IS_ERR_OR_NULL(fw_status))
+        if (!IS_ERR_OR_NULL(fw_status)) {
                 reasons = le32_to_cpu(fw_status->wakeup_reasons);
+                kfree(fw_status);
+        }
 
         if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED)
                 wakeup.rfkill_release = true;
@@ -1868,15 +1870,15 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
         /* get the BSS vif pointer again */
         vif = iwl_mvm_get_bss_vif(mvm);
         if (IS_ERR_OR_NULL(vif))
-                goto out_unlock;
+                goto err;
 
         ret = iwl_trans_d3_resume(mvm->trans, &d3_status, test);
         if (ret)
-                goto out_unlock;
+                goto err;
 
         if (d3_status != IWL_D3_STATUS_ALIVE) {
                 IWL_INFO(mvm, "Device was reset during suspend\n");
-                goto out_unlock;
+                goto err;
         }
 
         /* query SRAM first in case we want event logging */
@@ -1902,7 +1904,8 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
                 goto out_iterate;
         }
 
- out_unlock:
+err:
+        iwl_mvm_free_nd(mvm);
         mutex_unlock(&mvm->mutex);
 
 out_iterate:
@@ -1915,6 +1918,14 @@ out:
         /* return 1 to reconfigure the device */
         set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
         set_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status);
+
+        /* We always return 1, which causes mac80211 to do a reconfig
+         * with IEEE80211_RECONFIG_TYPE_RESTART.  This type of
+         * reconfig calls iwl_mvm_restart_complete(), where we unref
+         * the IWL_MVM_REF_UCODE_DOWN, so we need to take the
+         * reference here.
+         */
+        iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
         return 1;
 }
 
@@ -2021,7 +2032,6 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
         __iwl_mvm_resume(mvm, true);
         rtnl_unlock();
         iwl_abort_notification_waits(&mvm->notif_wait);
-        iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
         ieee80211_restart_hw(mvm->hw);
 
         /* wait for restart and disconnect all interfaces */