--- /dev/null
+From 6e46d8ce894374fc135c96a8d1057c6af1fef237 Mon Sep 17 00:00:00 2001
+From: Avraham Stern <avraham.stern@intel.com>
+Date: Fri, 18 Aug 2017 15:33:57 +0300
+Subject: mac80211: flush hw_roc_start work before cancelling the ROC
+
+From: Avraham Stern <avraham.stern@intel.com>
+
+commit 6e46d8ce894374fc135c96a8d1057c6af1fef237 upstream.
+
+When HW ROC is supported it is possible that after the HW notified
+that the ROC has started, the ROC was cancelled and another ROC was
+added while the hw_roc_start worker is waiting on the mutex (since
+cancelling the ROC and adding another one also holds the same mutex).
+As a result, the hw_roc_start worker will continue to run after the
+new ROC is added but before it is actually started by the HW.
+This may result in notifying userspace that the ROC has started before
+it actually does, or in case of management tx ROC, in an attempt to
+tx while not on the right channel.
+
+In addition, when the driver will notify mac80211 that the second ROC
+has started, mac80211 will warn that this ROC has already been
+notified.
+
+Fix this by flushing the hw_roc_start work before cancelling an ROC.
+
+Signed-off-by: Avraham Stern <avraham.stern@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/offchannel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/mac80211/offchannel.c
++++ b/net/mac80211/offchannel.c
+@@ -469,6 +469,8 @@ void ieee80211_roc_purge(struct ieee8021
+ struct ieee80211_roc_work *roc, *tmp;
+ LIST_HEAD(tmp_list);
+
++ flush_work(&local->hw_roc_start);
++
+ mutex_lock(&local->mtx);
+ list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
+ if (sdata && roc->sdata != sdata)
fs-proc-report-eip-esp-in-prod-pid-stat-for-coredumping.patch
scsi-scsi_transport_fc-fix-null-pointer-dereference-in-fc_bsg_job_timeout.patch
smb3-add-support-for-multidialect-negotiate-smb2.1-and-later.patch
+mac80211-fix-vlan-handling-with-txqs.patch
+mac80211_hwsim-use-proper-tx-power.patch
+mac80211-flush-hw_roc_start-work-before-cancelling-the-roc.patch
+mac80211-fix-deadlock-in-driver-managed-rx-ba-session-start.patch
+genirq-make-sparse_irq_lock-protect-what-it-should-protect.patch
+genirq-msi-fix-populating-multiple-interrupts.patch
+genirq-fix-cpumask-check-in-__irq_startup_managed.patch
cifs-release-cifs-root_cred-after-exit_cifs.patch
cifs-release-auth_key.response-for-reconnect.patch
fs-proc-report-eip-esp-in-prod-pid-stat-for-coredumping.patch
+mac80211-fix-vlan-handling-with-txqs.patch
+mac80211_hwsim-use-proper-tx-power.patch
+mac80211-flush-hw_roc_start-work-before-cancelling-the-roc.patch
+genirq-make-sparse_irq_lock-protect-what-it-should-protect.patch