1 files changed, 12 insertions, 3 deletions

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index d747da541747..6f8a73c64fb3 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -793,11 +793,20 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 flush_work(&sdata->work);
                 /*
                  * When we get here, the interface is marked down.
-                 * Call synchronize_rcu() to wait for the RX path
+                 * Call rcu_barrier() to wait both for the RX path
                  * should it be using the interface and enqueuing
-                 * frames at this very time on another CPU.
+                 * frames at this very time on another CPU, and
+                 * for the sta free call_rcu callbacks.
                  */
-                synchronize_rcu();
+                rcu_barrier();
+
+                /*
+                 * free_sta_rcu() enqueues a work for the actual
+                 * sta cleanup, so we need to flush it while
+                 * sdata is still valid.
+                 */
+                flush_workqueue(local->workqueue);
+
                 skb_queue_purge(&sdata->skb_queue);
 
                 /*