1 files changed, 8 insertions, 11 deletions

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index f1a80da4e56a..aa69a331f374 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1324,7 +1324,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         u32 changed = 0;
-        u8 bssid[ETH_ALEN];
 
         ASSERT_MGD_MTX(ifmgd);
 
@@ -1336,10 +1335,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_stop_poll(sdata);
 
-        memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
-
         ifmgd->associated = NULL;
-        memset(ifmgd->bssid, 0, ETH_ALEN);
 
         /*
          * we need to commit the associated = NULL change because the
@@ -1359,7 +1355,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         netif_carrier_off(sdata->dev);
 
         mutex_lock(&local->sta_mtx);
-        sta = sta_info_get(sdata, bssid);
+        sta = sta_info_get(sdata, ifmgd->bssid);
         if (sta) {
                 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
                 ieee80211_sta_tear_down_BA_sessions(sta, tx);
@@ -1368,13 +1364,16 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         /* deauthenticate/disassociate now */
         if (tx || frame_buf)
-                ieee80211_send_deauth_disassoc(sdata, bssid, stype, reason,
-                                               tx, frame_buf);
+                ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
+                                               reason, tx, frame_buf);
 
         /* flush out frame */
         if (tx)
                 drv_flush(local, false);
 
+        /* clear bssid only after building the needed mgmt frames */
+        memset(ifmgd->bssid, 0, ETH_ALEN);
+
         /* remove AP and TDLS peers */
         sta_info_flush(local, sdata);
 
@@ -2153,15 +2152,13 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                            mgmt->sa, status_code);
                 ieee80211_destroy_assoc_data(sdata, false);
         } else {
-                sdata_info(sdata, "associated\n");
-
                 if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
                         /* oops -- internal error -- send timeout for now */
-                        ieee80211_destroy_assoc_data(sdata, true);
-                        sta_info_destroy_addr(sdata, mgmt->bssid);
+                        ieee80211_destroy_assoc_data(sdata, false);
                         cfg80211_put_bss(*bss);
                         return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
                 }
+                sdata_info(sdata, "associated\n");
 
                 /*
                  * destroy assoc_data afterwards, as otherwise an idle