cfg80211: fix locking regression in monitor channel tracking

Michal's monitor channel tracking introduce a locking problem
as it locked the rdev lock inside the netdev notifier which
isn't allowed as we might already hold it if we get there by
removing an interface that is up.

Fix this by relying only on the RTNL to protect the interface
counters, the RTNL is always held in these code paths anyway.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
diff --git a/net/wireless/core.c b/net/wireless/core.c
index e13365f..eb60410 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -766,7 +766,7 @@
 	bool has_monitors_only_old = cfg80211_has_monitors_only(rdev);
 	bool has_monitors_only_new;
 
-	ASSERT_RDEV_LOCK(rdev);
+	ASSERT_RTNL();
 
 	rdev->num_running_ifaces += num;
 	if (iftype == NL80211_IFTYPE_MONITOR)
@@ -888,10 +888,8 @@
 		wdev->beacon_interval = 0;
 		break;
 	case NETDEV_DOWN:
-		dev_hold(dev);
-		cfg80211_lock_rdev(rdev);
 		cfg80211_update_iface_num(rdev, wdev->iftype, -1);
-		cfg80211_unlock_rdev(rdev);
+		dev_hold(dev);
 		queue_work(cfg80211_wq, &wdev->cleanup_work);
 		break;
 	case NETDEV_UP:
@@ -1001,9 +999,7 @@
 		mutex_unlock(&rdev->devlist_mtx);
 		if (ret)
 			return notifier_from_errno(ret);
-		cfg80211_lock_rdev(rdev);
 		cfg80211_update_iface_num(rdev, wdev->iftype, 1);
-		cfg80211_unlock_rdev(rdev);
 		break;
 	}