2 files changed, 8 insertions, 3 deletions

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 4839a2d97a3b..090aa5a47182 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -449,16 +449,18 @@ static int ieee80211_stop(struct net_device *dev)
         case NL80211_IFTYPE_STATION:
                 del_timer_sync(&sdata->u.mgd.chswitch_timer);
                 del_timer_sync(&sdata->u.mgd.timer);
+                del_timer_sync(&sdata->u.mgd.conn_mon_timer);
+                del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
                 /*
-                 * If the timer fired while we waited for it, it will have
-                 * requeued the work. Now the work will be running again
+                 * If any of the timers fired while we waited for it, it will
+                 * have queued its work. Now the work will be running again
                  * but will not rearm the timer again because it checks
                  * whether the interface is running, which, at this point,
                  * it no longer is.
                  */
                 cancel_work_sync(&sdata->u.mgd.work);
                 cancel_work_sync(&sdata->u.mgd.chswitch_work);
-
+                cancel_work_sync(&sdata->u.mgd.monitor_work);
                 cancel_work_sync(&sdata->u.mgd.beacon_loss_work);
 
                 /*
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 18dad229344c..e3b3156aca9e 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1163,6 +1163,9 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         const u8 *ssid;
         bool already = false;
 
+        if (!netif_running(sdata->dev))
+                return;
+
         mutex_lock(&ifmgd->mtx);
 
         if (!ifmgd->associated)