diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index b2a68bc9f0b4..072d2c628ea8 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -186,6 +186,7 @@ static void iforce_close(struct input_dev *dev)
 	struct iforce *iforce = input_get_drvdata(dev);
 	int i;
 
+	printk("iforce_close(%p) start\n", iforce);
 	if (test_bit(EV_FF, dev->evbit)) {
 		/* Check: no effects should be present in memory */
 		for (i = 0; i < dev->ff->max_effects; i++) {
@@ -197,14 +198,18 @@ static void iforce_close(struct input_dev *dev)
 			}
 		}
 
+		printk("iforce_send_packet(%p) start\n", iforce);
 		/* Disable force feedback playback */
-		iforce_send_packet(iforce, FF_CMD_ENABLE, "\001");
+		i = iforce_send_packet(iforce, FF_CMD_ENABLE, "\001");
+		printk("iforce_send_packet(%p)=%d\n", iforce, i);
 		/* Wait for the command to complete */
 		wait_event_interruptible(iforce->wait,
 			!test_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags));
+		printk("wait_event_interruptible(%p) end\n", iforce);
 	}
 
 	iforce->xport_ops->stop_io(iforce);
+	printk("iforce_close(%p) end\n", iforce);
 }
 
 int iforce_init_device(struct device *parent, u16 bustype,
diff --git a/drivers/input/joystick/iforce/iforce-serio.c b/drivers/input/joystick/iforce/iforce-serio.c
index f95a81b9fac7..2380546d7978 100644
--- a/drivers/input/joystick/iforce/iforce-serio.c
+++ b/drivers/input/joystick/iforce/iforce-serio.c
@@ -39,7 +39,7 @@ static void iforce_serio_xmit(struct iforce *iforce)
 
 again:
 	if (iforce->xmit.head == iforce->xmit.tail) {
-		clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
+		iforce_clear_xmit_and_wake(iforce);
 		spin_unlock_irqrestore(&iforce->xmit_lock, flags);
 		return;
 	}
@@ -64,7 +64,7 @@ static void iforce_serio_xmit(struct iforce *iforce)
 	if (test_and_clear_bit(IFORCE_XMIT_AGAIN, iforce->xmit_flags))
 		goto again;
 
-	clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
+	iforce_clear_xmit_and_wake(iforce);
 
 	spin_unlock_irqrestore(&iforce->xmit_lock, flags);
 }
@@ -169,7 +169,7 @@ static irqreturn_t iforce_serio_irq(struct serio *serio,
 			iforce_serio->cmd_response_len = iforce_serio->len;
 
 			/* Signal that command is done */
-			wake_up(&iforce->wait);
+			wake_up_all(&iforce->wait);
 		} else if (likely(iforce->type)) {
 			iforce_process_packet(iforce, iforce_serio->id,
 					      iforce_serio->data_in,
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index ea58805c480f..ca4b5257fd1a 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -30,7 +30,7 @@ static void __iforce_usb_xmit(struct iforce *iforce)
 	spin_lock_irqsave(&iforce->xmit_lock, flags);
 
 	if (iforce->xmit.head == iforce->xmit.tail) {
-		clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
+		iforce_clear_xmit_and_wake(iforce);
 		spin_unlock_irqrestore(&iforce->xmit_lock, flags);
 		return;
 	}
@@ -58,9 +58,9 @@ static void __iforce_usb_xmit(struct iforce *iforce)
 	XMIT_INC(iforce->xmit.tail, n);
 
 	if ( (n=usb_submit_urb(iforce_usb->out, GFP_ATOMIC)) ) {
-		clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
 		dev_warn(&iforce_usb->intf->dev,
 			 "usb_submit_urb failed %d\n", n);
+		iforce_clear_xmit_and_wake(iforce);
 	}
 
 	/* The IFORCE_XMIT_RUNNING bit is not cleared here. That's intended.
@@ -175,15 +175,15 @@ static void iforce_usb_out(struct urb *urb)
 	struct iforce *iforce = &iforce_usb->iforce;
 
 	if (urb->status) {
-		clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
-		dev_dbg(&iforce_usb->intf->dev, "urb->status %d, exiting\n",
+		dev_warn(&iforce_usb->intf->dev, "urb->status %d, exiting\n",
 			urb->status);
+		iforce_clear_xmit_and_wake(iforce);
 		return;
 	}
 
 	__iforce_usb_xmit(iforce);
 
-	wake_up(&iforce->wait);
+	wake_up_all(&iforce->wait);
 }
 
 static int iforce_usb_probe(struct usb_interface *intf,
@@ -256,14 +256,17 @@ static void iforce_usb_disconnect(struct usb_interface *intf)
 {
 	struct iforce_usb *iforce_usb = usb_get_intfdata(intf);
 
+	printk("iforce_usb_disconnect(%p) start\n", iforce_usb);
 	usb_set_intfdata(intf, NULL);
 
 	input_unregister_device(iforce_usb->iforce.dev);
+	printk("input_unregister_device(%p) end\n", iforce_usb);
 
 	usb_free_urb(iforce_usb->irq);
 	usb_free_urb(iforce_usb->out);
 
 	kfree(iforce_usb);
+	printk("iforce_usb_disconnect(%p) end\n", iforce_usb);
 }
 
 static const struct usb_device_id iforce_usb_ids[] = {
diff --git a/drivers/input/joystick/iforce/iforce.h b/drivers/input/joystick/iforce/iforce.h
index 6aa761ebbdf7..9ccb9107ccbe 100644
--- a/drivers/input/joystick/iforce/iforce.h
+++ b/drivers/input/joystick/iforce/iforce.h
@@ -119,6 +119,12 @@ static inline int iforce_get_id_packet(struct iforce *iforce, u8 id,
 					 response_data, response_len);
 }
 
+static inline void iforce_clear_xmit_and_wake(struct iforce *iforce)
+{
+	clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
+	wake_up_all(&iforce->wait);
+}
+
 /* Public functions */
 /* iforce-main.c */
 int iforce_init_device(struct device *parent, u16 bustype,
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index cff3ae8c818f..adc2c2ac9d94 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -204,8 +204,21 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout)
 	}
  unlock:
 	rcu_read_unlock();
-	if (hung_task_show_lock)
-		debug_show_all_locks();
+	if (hung_task_show_lock) {
+		pr_warn("\nShowing all threads with locks held in the system:\n");
+		rcu_read_lock();
+		for_each_process_thread(g, t) {
+			if (t->lockdep_depth && t != current) {
+				sched_show_task(t);
+				debug_show_held_locks(t);
+				touch_nmi_watchdog();
+				touch_all_softlockup_watchdogs();
+			}
+		}
+		rcu_read_unlock();
+		pr_warn("\n");
+		pr_warn("=============================================\n\n");
+	}
 
 	if (hung_task_show_all_bt) {
 		hung_task_show_all_bt = false;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 15a73b7fdd75..1a9ada411879 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -377,9 +377,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
 	bool cancel_scan;
 	struct cfg80211_nan_func *func;
 
-	spin_lock_bh(&local->fq.lock);
 	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
-	spin_unlock_bh(&local->fq.lock);
+	synchronize_rcu(); /* flush _ieee80211_wake_txqs() */
 
 	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
 	if (cancel_scan)