1 files changed, 41 insertions, 11 deletions

diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index c8717c1d082e..b50ee5d622e1 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -342,6 +342,40 @@ static const int compat_event_type_size[] = {
 
 /* IW event code */
 
+void wireless_nlevent_flush(void)
+{
+        struct sk_buff *skb;
+        struct net *net;
+
+        ASSERT_RTNL();
+
+        for_each_net(net) {
+                while ((skb = skb_dequeue(&net->wext_nlevents)))
+                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
+                                    GFP_KERNEL);
+        }
+}
+EXPORT_SYMBOL_GPL(wireless_nlevent_flush);
+
+static int wext_netdev_notifier_call(struct notifier_block *nb,
+                                     unsigned long state, void *ptr)
+{
+        /*
+         * When a netdev changes state in any way, flush all pending messages
+         * to avoid them going out in a strange order, e.g. RTM_NEWLINK after
+         * RTM_DELLINK, or with IFF_UP after without IFF_UP during dev_close()
+         * or similar - all of which could otherwise happen due to delays from
+         * schedule_work().
+         */
+        wireless_nlevent_flush();
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block wext_netdev_notifier = {
+        .notifier_call = wext_netdev_notifier_call,
+};
+
 static int __net_init wext_pernet_init(struct net *net)
 {
         skb_queue_head_init(&net->wext_nlevents);
@@ -360,7 +394,12 @@ static struct pernet_operations wext_pernet_ops = {
 
 static int __init wireless_nlevent_init(void)
 {
-        return register_pernet_subsys(&wext_pernet_ops);
+        int err = register_pernet_subsys(&wext_pernet_ops);
+
+        if (err)
+                return err;
+
+        return register_netdevice_notifier(&wext_netdev_notifier);
 }
 
 subsys_initcall(wireless_nlevent_init);
@@ -368,17 +407,8 @@ subsys_initcall(wireless_nlevent_init);
 /* Process events generated by the wireless layer or the driver. */
 static void wireless_nlevent_process(struct work_struct *work)
 {
-        struct sk_buff *skb;
-        struct net *net;
-
         rtnl_lock();
-
-        for_each_net(net) {
-                while ((skb = skb_dequeue(&net->wext_nlevents)))
-                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
-                                    GFP_KERNEL);
-        }
-
+        wireless_nlevent_flush();
         rtnl_unlock();
 }