ctx->vif is dereferenced in different part of iwlwifi code, so do not nullify it. This should address at least one of the possible reasons of WARNING at iwlagn_mac_remove_interface, and perhaps some random crashes when firmware reset is performed. Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka --- drivers/net/wireless/iwlwifi/iwl-agn.c | 3 --- drivers/net/wireless/iwlwifi/iwl-mac80211.c | 10 +++++++++- 2 files changed, 9 insertions(+), 4 deletions(-) --- linux-3.3.noarch.orig/drivers/net/wireless/iwlwifi/iwl-agn.c +++ linux-3.3.noarch/drivers/net/wireless/iwlwifi/iwl-agn.c @@ -1403,7 +1403,6 @@ static void iwl_bg_run_time_calib_work(s void iwlagn_prepare_restart(struct iwl_priv *priv) { - struct iwl_rxon_context *ctx; bool bt_full_concurrent; u8 bt_ci_compliance; u8 bt_load; @@ -1412,8 +1411,6 @@ void iwlagn_prepare_restart(struct iwl_p lockdep_assert_held(&priv->shrd->mutex); - for_each_context(priv, ctx) - ctx->vif = NULL; priv->is_open = 0; /* --- linux-3.3.noarch.orig/drivers/net/wireless/iwlwifi/iwl-mac80211.c +++ linux-3.3.noarch/drivers/net/wireless/iwlwifi/iwl-mac80211.c @@ -1226,6 +1226,7 @@ static int iwlagn_mac_add_interface(stru struct iwl_rxon_context *tmp, *ctx = NULL; int err; enum nl80211_iftype viftype = ieee80211_vif_type_p2p(vif); + bool reset = false; IWL_DEBUG_MAC80211(priv, "enter: type %d, addr %pM\n", viftype, vif->addr); @@ -1247,6 +1248,13 @@ static int iwlagn_mac_add_interface(stru tmp->interface_modes | tmp->exclusive_interface_modes; if (tmp->vif) { + /* On reset we need to add the same interface again */ + if (tmp->vif == vif) { + reset = true; + ctx = tmp; + break; + } + /* check if this busy context is exclusive */ if (tmp->exclusive_interface_modes & BIT(tmp->vif->type)) { @@ -1273,7 +1281,7 @@ static int iwlagn_mac_add_interface(stru ctx->vif = vif; err = iwl_setup_interface(priv, ctx); - if (!err) + if (!err || reset) goto out; ctx->vif = NULL;