1 files changed, 17 insertions, 9 deletions

diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index de9286703280..0216ab555249 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -256,8 +256,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
                 if (err)
                         goto out_err;
         } else {
-                memcpy(req->mac_addr, nla_data(info->attrs[NL80211_ATTR_MAC]),
-                       ETH_ALEN);
+                memcpy(req->mac_addr, wdev_address(wdev), ETH_ALEN);
                 memset(req->mac_addr_mask, 0xff, ETH_ALEN);
         }
 
@@ -272,6 +271,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
 
         req->n_peers = count;
         req->cookie = cfg80211_assign_cookie(rdev);
+        req->nl_portid = info->snd_portid;
 
         err = rdev_start_pmsr(rdev, wdev, req);
         if (err)
@@ -530,14 +530,14 @@ free:
 }
 EXPORT_SYMBOL_GPL(cfg80211_pmsr_report);
 
-void cfg80211_pmsr_free_wk(struct work_struct *work)
+static void cfg80211_pmsr_process_abort(struct wireless_dev *wdev)
 {
-        struct wireless_dev *wdev = container_of(work, struct wireless_dev,
-                                                 pmsr_free_wk);
         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_pmsr_request *req, *tmp;
         LIST_HEAD(free_list);
 
+        lockdep_assert_held(&wdev->mtx);
+
         spin_lock_bh(&wdev->pmsr_lock);
         list_for_each_entry_safe(req, tmp, &wdev->pmsr_list, list) {
                 if (req->nl_portid)
@@ -547,14 +547,22 @@ void cfg80211_pmsr_free_wk(struct work_struct *work)
         spin_unlock_bh(&wdev->pmsr_lock);
 
         list_for_each_entry_safe(req, tmp, &free_list, list) {
-                wdev_lock(wdev);
                 rdev_abort_pmsr(rdev, wdev, req);
-                wdev_unlock(wdev);
 
                 kfree(req);
         }
 }
 
+void cfg80211_pmsr_free_wk(struct work_struct *work)
+{
+        struct wireless_dev *wdev = container_of(work, struct wireless_dev,
+                                                 pmsr_free_wk);
+
+        wdev_lock(wdev);
+        cfg80211_pmsr_process_abort(wdev);
+        wdev_unlock(wdev);
+}
+
 void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
 {
         struct cfg80211_pmsr_request *req;
@@ -568,8 +576,8 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
         spin_unlock_bh(&wdev->pmsr_lock);
 
         if (found)
-                schedule_work(&wdev->pmsr_free_wk);
-        flush_work(&wdev->pmsr_free_wk);
+                cfg80211_pmsr_process_abort(wdev);
+
         WARN_ON(!list_empty(&wdev->pmsr_list));
 }