3 files changed, 6 insertions, 2 deletions

diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 6fac18c0423f..85572353a7e3 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -622,6 +622,7 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 
         del_timer_sync(&sdata->u.mesh.housekeeping_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
+        del_timer_sync(&sdata->u.mesh.mesh_path_timer);
         /*
          * If the timer fired while we waited for it, it will have
          * requeued the work. Now the work will be running again
@@ -634,6 +635,8 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         local->fif_other_bss--;
         atomic_dec(&local->iff_allmultis);
         ieee80211_configure_filter(local);
+
+        sdata->u.mesh.timers_running = 0;
 }
 
 static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index cef0c9e79aba..a4a5acdbaa4d 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1430,6 +1430,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
         del_timer_sync(&sdata->u.mgd.timer);
         del_timer_sync(&sdata->u.mgd.chswitch_timer);
+
+        sdata->u.mgd.timers_running = 0;
 }
 
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index bcaee5d12839..839dd9737989 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -299,7 +299,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
         if (local->scan_req != local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
-        local->scan_sdata = NULL;
+        rcu_assign_pointer(local->scan_sdata, NULL);
 
         local->scanning = 0;
         local->scan_channel = NULL;
@@ -984,7 +984,6 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
                         kfree(local->sched_scan_ies.ie[i]);
 
                 drv_sched_scan_stop(local, sdata);
-                rcu_assign_pointer(local->sched_scan_sdata, NULL);
         }
 out:
         mutex_unlock(&local->mtx);