1 files changed, 4 insertions, 4 deletions

diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index b890e225a8f1..b3b44a5dd375 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -779,10 +779,8 @@ void mesh_plink_broken(struct sta_info *sta)
 static void mesh_path_node_reclaim(struct rcu_head *rp)
 {
         struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
-        struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
 
         del_timer_sync(&node->mpath->timer);
-        atomic_dec(&sdata->u.mesh.mpaths);
         kfree(node->mpath);
         kfree(node);
 }
@@ -790,8 +788,9 @@ static void mesh_path_node_reclaim(struct rcu_head *rp)
 /* needs to be called with the corresponding hashwlock taken */
 static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)
 {
-        struct mesh_path *mpath;
-        mpath = node->mpath;
+        struct mesh_path *mpath = node->mpath;
+        struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
+
         spin_lock(&mpath->state_lock);
         mpath->flags |= MESH_PATH_RESOLVING;
         if (mpath->is_gate)
@@ -799,6 +798,7 @@ static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)
         hlist_del_rcu(&node->list);
         call_rcu(&node->rcu, mesh_path_node_reclaim);
         spin_unlock(&mpath->state_lock);
+        atomic_dec(&sdata->u.mesh.mpaths);
         atomic_dec(&tbl->entries);
 }