cfg80211: fix NETDEV_UNREGISTER notifier

It's possible to get the NETDEV_UNREGISTER callback multiple
times (see net/core/dev.c:netdev_wait_allrefs) and this will
completely mess up our cleanup code. To avoid that, clean up
only when the interface is still on the wiphy interface list
from which it's removed on the first NETDEV_UNREGISTER call.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/net/wireless/core.c b/net/wireless/core.c
index 755cdf1643c9b4adf618f6c7fa1d8a5588605a30..1493285b6a4db14925c39b7ce39c765145b11ace 100644 (file)
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -725,15 +725,22 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                break;
        case NETDEV_UNREGISTER:
                mutex_lock(&rdev->devlist_mtx);
+               /*
+                * It is possible to get NETDEV_UNREGISTER
+                * multiple times. To detect that, check
+                * that the interface is still on the list
+                * of registered interfaces, and only then
+                * remove and clean it up.
+                */
                if (!list_empty(&wdev->list)) {
                        sysfs_remove_link(&dev->dev.kobj, "phy80211");
                        list_del_init(&wdev->list);
-               }
-               mutex_unlock(&rdev->devlist_mtx);
-               mutex_destroy(&wdev->mtx);
+                       mutex_destroy(&wdev->mtx);
 #ifdef CONFIG_WIRELESS_EXT
-               kfree(wdev->wext.keys);
+                       kfree(wdev->wext.keys);
 #endif
+               }
+               mutex_unlock(&rdev->devlist_mtx);
                break;
        case NETDEV_PRE_UP:
                if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))