---

yaml
---
r: 215051
b: refs/heads/master
c: 52a2a37
h: refs/heads/master
i:
  215049: b7e88f7
  215047: 5df3f4a
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8c7f4f3166e16bb350bfc53955ea6cf9bfd34aab
+refs/heads/master: 52a2a37550b604b3c3c7a044ff72d85b60165659

trunk/drivers/net/wireless/wl12xx/wl1271_main.c

@@ -960,15 +960,10 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
 	return ret;
 }
 
-static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
-				       struct ieee80211_vif *vif)
+static void __wl1271_op_remove_interface(struct wl1271 *wl)
 {
-	struct wl1271 *wl = hw->priv;
 	int i;
 
-	cancel_work_sync(&wl->scan_complete_work);
-
-	mutex_lock(&wl->mutex);
 	wl1271_debug(DEBUG_MAC80211, "mac80211 remove interface");
 
 	wl1271_info("down");
@@ -994,6 +989,7 @@ static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
 
 	mutex_unlock(&wl->mutex);
 
+	cancel_work_sync(&wl->scan_complete_work);
 	cancel_work_sync(&wl->irq_work);
 	cancel_work_sync(&wl->tx_work);
 	cancel_delayed_work_sync(&wl->pspoll_work);
@@ -1039,7 +1035,16 @@ static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
 	wl->tx_res_if = NULL;
 	kfree(wl->target_mem_map);
 	wl->target_mem_map = NULL;
+}
 
+static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
+				       struct ieee80211_vif *vif)
+{
+	struct wl1271 *wl = hw->priv;
+
+	mutex_lock(&wl->mutex);
+	WARN_ON(wl->vif != vif);
+	__wl1271_op_remove_interface(wl);
 	mutex_unlock(&wl->mutex);
 }
 

trunk/drivers/net/wireless/wl12xx/wl1271_scan.c

@@ -36,6 +36,12 @@ void wl1271_scan_complete_work(struct work_struct *work)
 	wl1271_debug(DEBUG_SCAN, "Scanning complete");
 
 	mutex_lock(&wl->mutex);
+
+	if (wl->scan.state == WL1271_SCAN_STATE_IDLE) {
+		mutex_unlock(&wl->mutex);
+		return;
+	}
+
 	wl->scan.state = WL1271_SCAN_STATE_IDLE;
 	kfree(wl->scan.scanned_ch);
 	wl->scan.scanned_ch = NULL;