---

yaml
---
r: 66337
b: refs/heads/master
c: 2a8a9a8
h: refs/heads/master
i:
  66335: 61c7f87
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 4b6aa59999a3a12dd4740a52299c6c33e85a8747
+refs/heads/master: 2a8a9a88fc1b18f5c45244d0ef8a5352f6cf761f

trunk/net/mac80211/ieee80211.c

@@ -493,7 +493,16 @@ static void ieee80211_if_shutdown(struct net_device *dev)
 	case IEEE80211_IF_TYPE_IBSS:
 		sdata->u.sta.state = IEEE80211_DISABLED;
 		del_timer_sync(&sdata->u.sta.timer);
+		/*
+		 * Holding the sub_if_lock for writing here blocks
+		 * out the receive path and makes sure it's not
+		 * currently processing a packet that may get
+		 * added to the queue.
+		 */
+		write_lock_bh(&local->sub_if_lock);
 		skb_queue_purge(&sdata->u.sta.skb_queue);
+		write_unlock_bh(&local->sub_if_lock);
+
 		if (!local->ops->hw_scan &&
 		    local->scan_dev == sdata->dev) {
 			local->sta_scanning = 0;

trunk/net/mac80211/rx.c

@@ -1380,6 +1380,9 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
 	list_for_each_entry(sdata, &local->sub_if_list, list) {
 		rx.u.rx.ra_match = 1;
 
+		if (!netif_running(sdata->dev))
+			continue;
+
 		prepres = prepare_for_handlers(sdata, bssid, &rx, hdr);
 		/* prepare_for_handlers can change sta */
 		sta = rx.sta;