1 files changed, 5 insertions, 11 deletions

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3ad053f6de12..375cecc837a1 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1430,8 +1430,6 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
         int headroom;
         bool may_encrypt;
 
-        dev_hold(sdata->dev);
-
         if (need_dynamic_ps(local)) {
                 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
                         ieee80211_stop_queues_by_reason(&local->hw,
@@ -1446,6 +1444,8 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
 
         info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 
+        rcu_read_lock();
+
         if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
                 int hdrlen;
                 u16 len_rthdr;
@@ -1468,7 +1468,6 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                          * support we will need a different mechanism.
                          */
 
-                        rcu_read_lock();
                         list_for_each_entry_rcu(tmp_sdata, &local->interfaces,
                                                 list) {
                                 if (!netif_running(tmp_sdata->dev))
@@ -1477,13 +1476,10 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                                         continue;
                                 if (compare_ether_addr(tmp_sdata->dev->dev_addr,
                                                        hdr->addr2) == 0) {
-                                        dev_hold(tmp_sdata->dev);
-                                        dev_put(sdata->dev);
                                         sdata = tmp_sdata;
                                         break;
                                 }
                         }
-                        rcu_read_unlock();
                 }
         }
 
@@ -1497,7 +1493,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
 
         if (ieee80211_skb_resize(local, skb, headroom, may_encrypt)) {
                 dev_kfree_skb(skb);
-                dev_put(sdata->dev);
+                rcu_read_unlock();
                 return;
         }
 
@@ -1508,13 +1504,13 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                 !is_multicast_ether_addr(hdr->addr1))
                         if (mesh_nexthop_lookup(skb, sdata)) {
                                 /* skb queued: don't free */
-                                dev_put(sdata->dev);
+                                rcu_read_unlock();
                                 return;
                         }
 
         ieee80211_select_queue(local, skb);
         ieee80211_tx(sdata, skb, false);
-        dev_put(sdata->dev);
+        rcu_read_unlock();
 }
 
 netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
@@ -1964,12 +1960,10 @@ void ieee80211_tx_pending(unsigned long data)
                         }
 
                         sdata = vif_to_sdata(info->control.vif);
-                        dev_hold(sdata->dev);
                         spin_unlock_irqrestore(&local->queue_stop_reason_lock,
                                                 flags);
 
                         txok = ieee80211_tx_pending_skb(local, skb);
-                        dev_put(sdata->dev);
                         if (!txok)
                                 __skb_queue_head(&local->pending[i], skb);
                         spin_lock_irqsave(&local->queue_stop_reason_lock,