5 files changed, 20 insertions, 34 deletions

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index d7a96ced2c83..a9ff904620db 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -779,7 +779,7 @@ static void ieee80211_ibss_work(struct work_struct *work)
                 return;
         ifibss = &sdata->u.ibss;
 
-        while ((skb = skb_dequeue(&ifibss->skb_queue)))
+        while ((skb = skb_dequeue(&sdata->skb_queue)))
                 ieee80211_ibss_rx_queued_mgmt(sdata, skb);
 
         if (!test_and_clear_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request))
@@ -850,7 +850,6 @@ void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
         INIT_WORK(&ifibss->work, ieee80211_ibss_work);
         setup_timer(&ifibss->timer, ieee80211_ibss_timer,
                     (unsigned long) sdata);
-        skb_queue_head_init(&ifibss->skb_queue);
 }
 
 /* scan finished notification */
@@ -890,7 +889,7 @@ ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         case IEEE80211_STYPE_BEACON:
         case IEEE80211_STYPE_PROBE_REQ:
         case IEEE80211_STYPE_AUTH:
-                skb_queue_tail(&sdata->u.ibss.skb_queue, skb);
+                skb_queue_tail(&sdata->skb_queue, skb);
                 ieee80211_queue_work(&local->hw, &sdata->u.ibss.work);
                 return RX_QUEUED;
         }
@@ -983,7 +982,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         synchronize_rcu();
         kfree_skb(skb);
 
-        skb_queue_purge(&sdata->u.ibss.skb_queue);
+        skb_queue_purge(&sdata->skb_queue);
         memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
         sdata->u.ibss.ssid_len = 0;
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 5782a537f74a..3cc3867c5418 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -340,8 +340,6 @@ struct ieee80211_if_managed {
 
         u16 aid;
 
-        struct sk_buff_head skb_queue;
-
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
@@ -388,8 +386,6 @@ struct ieee80211_if_ibss {
         struct timer_list timer;
         struct work_struct work;
 
-        struct sk_buff_head skb_queue;
-
         unsigned long request;
         unsigned long last_scan_completed;
 
@@ -420,7 +416,6 @@ struct ieee80211_if_mesh {
         struct timer_list housekeeping_timer;
         struct timer_list mesh_path_timer;
         struct timer_list mesh_path_root_timer;
-        struct sk_buff_head skb_queue;
 
         unsigned long timers_running;
 
@@ -517,6 +512,8 @@ struct ieee80211_sub_if_data {
 
         u16 sequence_number;
 
+        struct sk_buff_head skb_queue;
+
         /*
          * AP this belongs to: self in AP mode and
          * corresponding AP in VLAN mode, NULL for
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 906fc2be0cfb..56167a3d872d 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -465,21 +465,11 @@ static int ieee80211_stop(struct net_device *dev)
                 cancel_work_sync(&sdata->u.mgd.monitor_work);
                 cancel_work_sync(&sdata->u.mgd.beacon_connection_loss_work);
 
-                /*
-                 * When we get here, the interface is marked down.
-                 * Call synchronize_rcu() to wait for the RX path
-                 * should it be using the interface and enqueuing
-                 * frames at this very time on another CPU.
-                 */
-                synchronize_rcu();
-                skb_queue_purge(&sdata->u.mgd.skb_queue);
                 /* fall through */
         case NL80211_IFTYPE_ADHOC:
                 if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                         del_timer_sync(&sdata->u.ibss.timer);
                         cancel_work_sync(&sdata->u.ibss.work);
-                        synchronize_rcu();
-                        skb_queue_purge(&sdata->u.ibss.skb_queue);
                 }
                 /* fall through */
         case NL80211_IFTYPE_MESH_POINT:
@@ -495,6 +485,15 @@ static int ieee80211_stop(struct net_device *dev)
                 }
                 /* fall through */
         default:
+                /*
+                 * When we get here, the interface is marked down.
+                 * Call synchronize_rcu() to wait for the RX path
+                 * should it be using the interface and enqueuing
+                 * frames at this very time on another CPU.
+                 */
+                synchronize_rcu();
+                skb_queue_purge(&sdata->skb_queue);
+
                 if (local->scan_sdata == sdata)
                         ieee80211_scan_cancel(local);
 
@@ -721,6 +720,8 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         /* only monitor differs */
         sdata->dev->type = ARPHRD_ETHER;
 
+        skb_queue_head_init(&sdata->skb_queue);
+
         switch (type) {
         case NL80211_IFTYPE_AP:
                 skb_queue_head_init(&sdata->u.ap.ps_bc_buf);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index bde81031727a..065533a37abe 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -537,15 +537,6 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
          * it no longer is.
          */
         cancel_work_sync(&sdata->u.mesh.work);
-
-        /*
-         * When we get here, the interface is marked down.
-         * Call synchronize_rcu() to wait for the RX path
-         * should it be using the interface and enqueuing
-         * frames at this very time on another CPU.
-         */
-        rcu_barrier(); /* Wait for RX path and call_rcu()'s */
-        skb_queue_purge(&sdata->u.mesh.skb_queue);
 }
 
 static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
@@ -650,7 +641,7 @@ static void ieee80211_mesh_work(struct work_struct *work)
         if (local->scanning)
                 return;
 
-        while ((skb = skb_dequeue(&ifmsh->skb_queue)))
+        while ((skb = skb_dequeue(&sdata->skb_queue)))
                 ieee80211_mesh_rx_queued_mgmt(sdata, skb);
 
         if (ifmsh->preq_queue_len &&
@@ -690,7 +681,6 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         setup_timer(&ifmsh->housekeeping_timer,
                     ieee80211_mesh_housekeeping_timer,
                     (unsigned long) sdata);
-        skb_queue_head_init(&sdata->u.mesh.skb_queue);
 
         ifmsh->mshcfg.dot11MeshRetryTimeout = MESH_RET_T;
         ifmsh->mshcfg.dot11MeshConfirmTimeout = MESH_CONF_T;
@@ -750,7 +740,7 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         case IEEE80211_STYPE_ACTION:
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
-                skb_queue_tail(&ifmsh->skb_queue, skb);
+                skb_queue_tail(&sdata->skb_queue, skb);
                 ieee80211_queue_work(&local->hw, &ifmsh->work);
                 return RX_QUEUED;
         }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0154d74905c9..854ef4ed2cfa 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1652,7 +1652,7 @@ ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
         case IEEE80211_STYPE_DEAUTH:
         case IEEE80211_STYPE_DISASSOC:
         case IEEE80211_STYPE_ACTION:
-                skb_queue_tail(&sdata->u.mgd.skb_queue, skb);
+                skb_queue_tail(&sdata->skb_queue, skb);
                 ieee80211_queue_work(&local->hw, &sdata->u.mgd.work);
                 return RX_QUEUED;
         }
@@ -1810,7 +1810,7 @@ static void ieee80211_sta_work(struct work_struct *work)
         ifmgd = &sdata->u.mgd;
 
         /* first process frames to avoid timing out while a frame is pending */
-        while ((skb = skb_dequeue(&ifmgd->skb_queue)))
+        while ((skb = skb_dequeue(&sdata->skb_queue)))
                 ieee80211_sta_rx_queued_mgmt(sdata, skb);
 
         /* then process the rest of the work */
@@ -1967,7 +1967,6 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
                     (unsigned long) sdata);
         setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
                     (unsigned long) sdata);
-        skb_queue_head_init(&ifmgd->skb_queue);
 
         ifmgd->flags = 0;