mac80211: assure we also cancel deferred scan request

This is partial revert and fix for commit
85f72bc839705294b32b6c16b491c0422f0a71b3 "mac80211: only cancel
software-based scans on suspend"

When cfg80211 request the scan and mac80211 perform some management work,
we defer the scan request. We do not canceling such requests when calling
ieee80211_scan_cancel(), because of SCAN_SW_SCANNING bit check just
before the call. So fix that problem.

Another problem, which commit 85f72bc839705294b32b6c16b491c0422f0a71b3
tries to solve, is we can not cancel HW scan. Hence patch make
ieee80211_scan_cancel() ignore HW scan (see code comments). Keeping
local->mtx lock assures that the deferred scan will not become
"working" HW scan.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

3 files changed, 27 insertions, 14 deletions

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index e3717092115f..915ecf87e4ac 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -307,8 +307,7 @@ static void ieee80211_restart_work(struct work_struct *work)
         mutex_unlock(&local->mtx);
 
         rtnl_lock();
-        if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)))
-                ieee80211_scan_cancel(local);
+        ieee80211_scan_cancel(local);
         ieee80211_reconfig(local);
         rtnl_unlock();
 }
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index e3e2bce3bb41..e37355193ed1 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -12,8 +12,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
 
-        if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)))
-                ieee80211_scan_cancel(local);
+        ieee80211_scan_cancel(local);
 
         ieee80211_stop_queues_by_reason(hw,
                         IEEE80211_QUEUE_STOP_REASON_SUSPEND);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 6964a4598176..4dbef714d946 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -793,24 +793,39 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
         return ret;
 }
 
+/*
+ * Only call this function when a scan can't be queued -- under RTNL.
+ */
 void ieee80211_scan_cancel(struct ieee80211_local *local)
 {
-        bool abortscan;
-        bool finish = false;
-
-        cancel_delayed_work_sync(&local->scan_work);
+        bool abortscan, finish;
 
         /*
-         * Only call this function when a scan can't be
-         * queued -- mostly at suspend under RTNL.
+         * We are only canceling software scan, or deferred scan that was not
+         * yet really started (see __ieee80211_start_scan ).
+         *
+         * Regarding hardware scan:
+         * - we can not call  __ieee80211_scan_completed() as when
+         *   SCAN_HW_SCANNING bit is set this function change
+         *   local->hw_scan_req to operate on 5G band, what race with
+         *   driver which can use local->hw_scan_req
+         *
+         * - we can not cancel scan_work since driver can schedule it
+         *   by ieee80211_scan_completed(..., true) to finish scan
+         *
+         * Hence low lever driver is responsible for canceling HW scan.
          */
+
         mutex_lock(&local->mtx);
-        abortscan = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
-                    (!local->scanning && local->scan_req);
+        abortscan = local->scan_req && !test_bit(SCAN_HW_SCANNING, &local->scanning);
         if (abortscan)
                 finish = __ieee80211_scan_completed(&local->hw, true, false);
         mutex_unlock(&local->mtx);
 
-        if (finish)
-                __ieee80211_scan_completed_finish(&local->hw, false);
+        if (abortscan) {
+                /* The scan is canceled, but stop work from being pending */
+                cancel_delayed_work_sync(&local->scan_work);
+                if (finish)
+                        __ieee80211_scan_completed_finish(&local->hw, false);
+        }
 }