4 files changed, 29 insertions, 9 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index be019533b233..908f1153942d 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1010,8 +1010,13 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
                 kfree_rcu(old_probe_resp, rcu_head);
 
         list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
-                sta_info_flush(vlan);
-        sta_info_flush(sdata);
+                sta_info_flush_defer(vlan);
+        sta_info_flush_defer(sdata);
+        rcu_barrier();
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                sta_info_flush_cleanup(vlan);
+        sta_info_flush_cleanup(sdata);
+
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
 
         drv_stop_ap(sdata->local, sdata);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 12341efb109e..1ab7d8e57d39 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -863,12 +863,15 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 cancel_work_sync(&sdata->work);
                 /*
                  * When we get here, the interface is marked down.
-                 * sta_info_flush_cleanup() calls rcu_barrier to
-                 * wait for the station call_rcu() calls to complete,
-                 * here we require it to wait for the RX path in case
-                 * it is using the interface and enqueuing frames at
-                 * this very time on another CPU.
+                 *
+                 * sta_info_flush_cleanup() requires rcu_barrier()
+                 * first to wait for the station call_rcu() calls
+                 * to complete, here we need at least sychronize_rcu()
+                 * it to wait for the RX path in case it is using the
+                 * interface and enqueuing frames at this very time on
+                 * another CPU.
                  */
+                rcu_barrier();
                 sta_info_flush_cleanup(sdata);
 
                 skb_queue_purge(&sdata->skb_queue);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7199b9d5b2f4..738f9349c0a2 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -920,8 +920,6 @@ int sta_info_flush_defer(struct ieee80211_sub_if_data *sdata)
 
 void sta_info_flush_cleanup(struct ieee80211_sub_if_data *sdata)
 {
-        rcu_barrier();
-
         ieee80211_cleanup_sdata_stas(sdata);
         cancel_work_sync(&sdata->cleanup_stations_wk);
 }
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index c3266aed4a07..031e4a5bbeca 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -549,6 +549,19 @@ void sta_info_recalc_tim(struct sta_info *sta);
 void sta_info_init(struct ieee80211_local *local);
 void sta_info_stop(struct ieee80211_local *local);
 int sta_info_flush_defer(struct ieee80211_sub_if_data *sdata);
+
+/**
+ * sta_info_flush_cleanup - flush the sta_info cleanup queue
+ * @sdata: the interface
+ *
+ * Flushes the sta_info cleanup queue for a given interface;
+ * this is necessary before the interface is removed or, for
+ * AP/mesh interfaces, before it is deconfigured.
+ *
+ * Note an rcu_barrier() must precede the function, after all
+ * stations have been flushed/removed to ensure the call_rcu()
+ * calls that add stations to the cleanup queue have completed.
+ */
 void sta_info_flush_cleanup(struct ieee80211_sub_if_data *sdata);
 
 /**
@@ -562,6 +575,7 @@ static inline int sta_info_flush(struct ieee80211_sub_if_data *sdata)
 {
         int ret = sta_info_flush_defer(sdata);
 
+        rcu_barrier();
         sta_info_flush_cleanup(sdata);
 
         return ret;