1 files changed, 31 insertions, 2 deletions

diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 1ff7ec08532d..35feebfd048f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -2215,7 +2215,19 @@ static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
 
         mutex_lock(&mvm->mutex);
 
-        iwl_mvm_cancel_scan(mvm);
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a hw_scan when it's already stopped.  This can
+         * happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_scan_completed() and the userspace called
+         * cancel scan scan before ieee80211_scan_work() could run.
+         * To handle that, simply return if the scan is not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if ((mvm->scan_status == IWL_MVM_SCAN_OS) ||
+            (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN))
+                iwl_mvm_cancel_scan(mvm);
 
         mutex_unlock(&mvm->mutex);
 }
@@ -2559,12 +2571,29 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
         int ret;
 
         mutex_lock(&mvm->mutex);
+
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a sched_scan when it's already stopped.  This
+         * can happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_sched_scan_stopped() and the userspace called
+         * stop sched scan scan before ieee80211_sched_scan_stopped_work()
+         * could run.  To handle this, simply return if the scan is
+         * not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
+            !(mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
+                mutex_unlock(&mvm->mutex);
+                return 0;
+        }
+
         ret = iwl_mvm_scan_offload_stop(mvm, false);
         mutex_unlock(&mvm->mutex);
         iwl_mvm_wait_for_async_handlers(mvm);
 
         return ret;
-
 }
 
 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,