2 files changed, 9 insertions, 1 deletions

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 18fdeca43d98..fda97bb0018b 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -365,7 +365,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return NOTIFY_DONE;
 
-        idev = sdata->dev->ip_ptr;
+        idev = __in_dev_get_rtnl(sdata->dev);
         if (!idev)
                 return NOTIFY_DONE;
 
@@ -868,6 +868,12 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
+        /*
+         * Now all work items will be gone, but the
+         * timer might still be armed, so delete it
+         */
+        del_timer_sync(&local->work_timer);
+
         cancel_work_sync(&local->restart_work);
         cancel_work_sync(&local->reconfig_filter);
 
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index f77a45625c0b..4f772de2f213 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -103,6 +103,7 @@ ieee80211_rate_control_ops_get(const char *name)
         struct rate_control_ops *ops;
         const char *alg_name;
 
+        kparam_block_sysfs_write(ieee80211_default_rc_algo);
         if (!name)
                 alg_name = ieee80211_default_rc_algo;
         else
@@ -120,6 +121,7 @@ ieee80211_rate_control_ops_get(const char *name)
         /* try built-in one if specific alg requested but not found */
         if (!ops && strlen(CONFIG_MAC80211_RC_DEFAULT))
                 ops = ieee80211_try_rate_control_ops_get(CONFIG_MAC80211_RC_DEFAULT);
+        kparam_unblock_sysfs_write(ieee80211_default_rc_algo);
 
         return ops;
 }