1 files changed, 12 insertions, 7 deletions

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index d9e6e81ff6b2..b83870bf60fa 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -67,7 +67,8 @@ static int sta_info_hash_del(struct ieee80211_local *local,
 {
         struct sta_info *s;
 
-        s = local->sta_hash[STA_HASH(sta->sta.addr)];
+        s = rcu_dereference_protected(local->sta_hash[STA_HASH(sta->sta.addr)],
+                                      lockdep_is_held(&local->sta_lock));
         if (!s)
                 return -ENOENT;
         if (s == sta) {
@@ -76,9 +77,11 @@ static int sta_info_hash_del(struct ieee80211_local *local,
                 return 0;
         }
 
-        while (s->hnext && s->hnext != sta)
-                s = s->hnext;
-        if (s->hnext) {
+        while (rcu_access_pointer(s->hnext) &&
+               rcu_access_pointer(s->hnext) != sta)
+                s = rcu_dereference_protected(s->hnext,
+                                        lockdep_is_held(&local->sta_lock));
+        if (rcu_access_pointer(s->hnext)) {
                 rcu_assign_pointer(s->hnext, sta->hnext);
                 return 0;
         }
@@ -274,7 +277,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
 #ifdef CONFIG_MAC80211_MESH
-        sta->plink_state = PLINK_LISTEN;
+        sta->plink_state = NL80211_PLINK_LISTEN;
         init_timer(&sta->plink_timer);
 #endif
 
@@ -652,10 +655,12 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
         if (ret)
                 return ret;
 
+        mutex_lock(&local->key_mtx);
         for (i = 0; i < NUM_DEFAULT_KEYS; i++)
-                ieee80211_key_free(local, sta->gtk[i]);
+                __ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]));
         if (sta->ptk)
-                ieee80211_key_free(local, sta->ptk);
+                __ieee80211_key_free(key_mtx_dereference(local, sta->ptk));
+        mutex_unlock(&local->key_mtx);
 
         sta->dead = true;