2 files changed, 6 insertions, 4 deletions

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 18fdeca43d98..7c8542627351 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -868,6 +868,12 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
+        /*
+         * Now all work items will be gone, but the
+         * timer might still be armed, so delete it
+         */
+        del_timer_sync(&local->work_timer);
+
         cancel_work_sync(&local->restart_work);
         cancel_work_sync(&local->reconfig_filter);
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c0368152b721..308e502a80eb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2286,9 +2286,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
         struct net_device *prev_dev = NULL;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
-        if (status->flag & RX_FLAG_INTERNAL_CMTR)
-                goto out_free_skb;
-
         if (skb_headroom(skb) < sizeof(*rthdr) &&
             pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
                 goto out_free_skb;
@@ -2347,7 +2344,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
         } else
                 goto out_free_skb;
 
-        status->flag |= RX_FLAG_INTERNAL_CMTR;
         return;
 
  out_free_skb: