1 files changed, 41 insertions, 19 deletions

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index fbef7a1ada7a..bfb57dcc1538 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -112,10 +112,11 @@ static u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                 }
         }
 
-        if (local->scan_sdata &&
-            !(local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)) {
+        sdata = rcu_dereference_protected(local->scan_sdata,
+                                          lockdep_is_held(&local->mtx));
+        if (sdata && !(local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)) {
                 scanning = true;
-                local->scan_sdata->vif.bss_conf.idle = false;
+                sdata->vif.bss_conf.idle = false;
         }
 
         list_for_each_entry(sdata, &local->interfaces, list) {
@@ -330,20 +331,24 @@ static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
         sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
 }
 
-int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
+static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
-        int ret;
+        int ret = 0;
 
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return 0;
 
+        mutex_lock(&local->iflist_mtx);
+
         if (local->monitor_sdata)
-                return 0;
+                goto out_unlock;
 
         sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
-        if (!sdata)
-                return -ENOMEM;
+        if (!sdata) {
+                ret = -ENOMEM;
+                goto out_unlock;
+        }
 
         /* set up data */
         sdata->local = local;
@@ -357,31 +362,34 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         if (WARN_ON(ret)) {
                 /* ok .. stupid driver, it asked for this! */
                 kfree(sdata);
-                return ret;
+                goto out_unlock;
         }
 
         ret = ieee80211_check_queues(sdata);
         if (ret) {
                 kfree(sdata);
-                return ret;
+                goto out_unlock;
         }
 
         rcu_assign_pointer(local->monitor_sdata, sdata);
-
-        return 0;
+ out_unlock:
+        mutex_unlock(&local->iflist_mtx);
+        return ret;
 }
 
-void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
+static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
 
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return;
 
-        sdata = rtnl_dereference(local->monitor_sdata);
+        mutex_lock(&local->iflist_mtx);
 
+        sdata = rcu_dereference_protected(local->monitor_sdata,
+                                          lockdep_is_held(&local->iflist_mtx));
         if (!sdata)
-                return;
+                goto out_unlock;
 
         rcu_assign_pointer(local->monitor_sdata, NULL);
         synchronize_net();
@@ -389,6 +397,8 @@ void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
         drv_remove_interface(local, sdata);
 
         kfree(sdata);
+ out_unlock:
+        mutex_unlock(&local->iflist_mtx);
 }
 
 /*
@@ -487,6 +497,12 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                         break;
                 }
 
+                if (local->monitors == 0 && local->open_count == 0) {
+                        res = ieee80211_add_virtual_monitor(local);
+                        if (res)
+                                goto err_stop;
+                }
+
                 /* must be before the call to ieee80211_configure_filter */
                 local->monitors++;
                 if (local->monitors == 1) {
@@ -501,6 +517,8 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 break;
         default:
                 if (coming_up) {
+                        ieee80211_del_virtual_monitor(local);
+
                         res = drv_add_interface(local, sdata);
                         if (res)
                                 goto err_stop;
@@ -628,7 +646,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
-        if (local->scan_sdata == sdata)
+        if (rcu_access_pointer(local->scan_sdata) == sdata)
                 ieee80211_scan_cancel(local);
 
         /*
@@ -735,6 +753,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 if (local->monitors == 0) {
                         local->hw.conf.flags &= ~IEEE80211_CONF_MONITOR;
                         hw_reconf_flags |= IEEE80211_CONF_CHANGE_MONITOR;
+                        ieee80211_del_virtual_monitor(local);
                 }
 
                 ieee80211_adjust_monitor_flags(sdata, -1);
@@ -808,6 +827,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 }
         }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+
+        if (local->monitors == local->open_count && local->monitors > 0)
+                ieee80211_add_virtual_monitor(local);
 }
 
 static int ieee80211_stop(struct net_device *dev)
@@ -1373,7 +1395,7 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
 }
 
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
-                     struct net_device **new_dev, enum nl80211_iftype type,
+                     struct wireless_dev **new_wdev, enum nl80211_iftype type,
                      struct vif_params *params)
 {
         struct net_device *ndev;
@@ -1463,8 +1485,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         list_add_tail_rcu(&sdata->list, &local->interfaces);
         mutex_unlock(&local->iflist_mtx);
 
-        if (new_dev)
-                *new_dev = ndev;
+        if (new_wdev)
+                *new_wdev = &sdata->wdev;
 
         return 0;