[PATCH] staging: rtl8723bs: fix timer rescheduling in rtw_cmd callbacks

[PATCH] staging: rtl8723bs: fix timer rescheduling in rtw_cmd callbacks

[Ganesh Harshan]

Ensure scan and association timers are deleted before being
rescheduled when command execution fails.

Without deleting the existing timer, multiple timer instances
may be active simultaneously, potentially leading to duplicate
timeout handling or unexpected behavior.

Use timer_delete_sync() to safely stop active timers before
rescheduling.

Signed-off-by: Ganesh Harshan <ganeshredcobra@gmail.com>
---
 drivers/staging/rtl8723bs/core/rtw_cmd.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_cmd.c b/drivers/staging/rtl8723bs/core/rtw_cmd.c
index b932670f5d63..967c3258e0b8 100644
--- a/drivers/staging/rtl8723bs/core/rtw_cmd.c
+++ b/drivers/staging/rtl8723bs/core/rtw_cmd.c
@@ -1801,7 +1801,9 @@ void rtw_survey_cmd_callback(struct adapter *padapter,  struct cmd_obj *pcmd)
 	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
 
 	if (pcmd->res != H2C_SUCCESS) {
-		/* TODO: cancel timer and do timeout handler directly... */
+		/* Ensure timer is safely rescheduled */
+		if (timer_pending(&pmlmepriv->scan_to_timer))
+			timer_delete_sync(&pmlmepriv->scan_to_timer);
 		_set_timer(&pmlmepriv->scan_to_timer, 1);
 	}
 
@@ -1829,7 +1831,9 @@ void rtw_joinbss_cmd_callback(struct adapter *padapter,  struct cmd_obj *pcmd)
 	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
 
 	if (pcmd->res != H2C_SUCCESS) {
-		/* TODO: cancel timer and do timeout handler directly... */
+		/* Ensure timer is safely rescheduled */
+		if (timer_pending(&pmlmepriv->assoc_timer))
+			timer_delete_sync(&pmlmepriv->assoc_timer);
 		_set_timer(&pmlmepriv->assoc_timer, 1);
 	}
 
-- 
2.47.3

Re: [PATCH] staging: rtl8723bs: fix timer rescheduling in rtw_cmd callbacks

[Dan Carpenter]

On Mon, Jun 22, 2026 at 07:04:48PM -0400, Ganesh Harshan wrote:
> Ensure scan and association timers are deleted before being
> rescheduled when command execution fails.
> 
> Without deleting the existing timer, multiple timer instances
> may be active simultaneously, potentially leading to duplicate
> timeout handling or unexpected behavior.
> 
> Use timer_delete_sync() to safely stop active timers before
> rescheduling.
> 
> Signed-off-by: Ganesh Harshan <ganeshredcobra@gmail.com>
> ---
>  drivers/staging/rtl8723bs/core/rtw_cmd.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/staging/rtl8723bs/core/rtw_cmd.c b/drivers/staging/rtl8723bs/core/rtw_cmd.c
> index b932670f5d63..967c3258e0b8 100644
> --- a/drivers/staging/rtl8723bs/core/rtw_cmd.c
> +++ b/drivers/staging/rtl8723bs/core/rtw_cmd.c
> @@ -1801,7 +1801,9 @@ void rtw_survey_cmd_callback(struct adapter *padapter,  struct cmd_obj *pcmd)
>  	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
>  
>  	if (pcmd->res != H2C_SUCCESS) {
> -		/* TODO: cancel timer and do timeout handler directly... */
> +		/* Ensure timer is safely rescheduled */
> +		if (timer_pending(&pmlmepriv->scan_to_timer))
> +			timer_delete_sync(&pmlmepriv->scan_to_timer);
>  		_set_timer(&pmlmepriv->scan_to_timer, 1);

Sorry, but this seems like a pointless change.

The _set_timer(&pmlmepriv->scan_to_timer, 1) means we want the timer to
trigger in 1 ms.  In the current code if it's already running, it will
run again in 1ms.

In your code, we test if it's running and if it is then we wait for it
to stop and then delete the timer so nothing else can run, and then we
run it again in 1ms.

The result is 100% the same either way.  Either way we call the
rtw_scan_timeout_handler() function twice.  And that's fine so far as
I can see.

You have misunderstood the comment.  They wanted to disable the timer
and call rtw_scan_timeout_handler() right away instead of with a 1ms
delay.  I don't know how much weight I would put in this comment.  We
won't be able accept a change like that unless you are able to test it.

regards,
dan carpenter