1 files changed, 22 insertions, 6 deletions

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 4fb2709cb527..513627896204 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -256,8 +256,27 @@ static void ieee80211_restart_work(struct work_struct *work)
 
         flush_work(&local->radar_detected_work);
         rtnl_lock();
-        list_for_each_entry(sdata, &local->interfaces, list)
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                /*
+                 * XXX: there may be more work for other vif types and even
+                 * for station mode: a good thing would be to run most of
+                 * the iface type's dependent _stop (ieee80211_mg_stop,
+                 * ieee80211_ibss_stop) etc...
+                 * For now, fix only the specific bug that was seen: race
+                 * between csa_connection_drop_work and us.
+                 */
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        /*
+                         * This worker is scheduled from the iface worker that
+                         * runs on mac80211's workqueue, so we can't be
+                         * scheduling this worker after the cancel right here.
+                         * The exception is ieee80211_chswitch_done.
+                         * Then we can have a race...
+                         */
+                        cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
+                }
                 flush_delayed_work(&sdata->dec_tailroom_needed_wk);
+        }
         ieee80211_scan_cancel(local);
 
         /* make sure any new ROC will consider local->in_reconfig */
@@ -471,10 +490,7 @@ static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = {
                 cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC |
                             IEEE80211_VHT_CAP_SHORT_GI_80 |
                             IEEE80211_VHT_CAP_SHORT_GI_160 |
-                            IEEE80211_VHT_CAP_RXSTBC_1 |
-                            IEEE80211_VHT_CAP_RXSTBC_2 |
-                            IEEE80211_VHT_CAP_RXSTBC_3 |
-                            IEEE80211_VHT_CAP_RXSTBC_4 |
+                            IEEE80211_VHT_CAP_RXSTBC_MASK |
                             IEEE80211_VHT_CAP_TXSTBC |
                             IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
                             IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
@@ -1208,6 +1224,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 #if IS_ENABLED(CONFIG_IPV6)
         unregister_inet6addr_notifier(&local->ifa6_notifier);
 #endif
+        ieee80211_txq_teardown_flows(local);
 
         rtnl_lock();
 
@@ -1236,7 +1253,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         skb_queue_purge(&local->skb_queue);
         skb_queue_purge(&local->skb_queue_unreliable);
         skb_queue_purge(&local->skb_queue_tdls_chsw);
-        ieee80211_txq_teardown_flows(local);
 
         destroy_workqueue(local->workqueue);
         wiphy_unregister(local->hw.wiphy);