[PATCH 2/3] wifi: rsi: report background scan start failures

[Zhao Li]

rsi_mac80211_hw_scan_start() returns success when a background-scan
command cannot be prepared. The driver never marks the scan active in
that case, so neither cancellation nor the firmware-event path reports
completion and mac80211 keeps the request pending.

Build the probe request before queueing the start parameters, propagate
preparation errors, and clear the saved request before mac80211 frees it.
Successful scans keep the existing firmware command order.

LLM assistance was used to find the bug and review.

Fixes: 7fdcb8e12660 ("rsi: add support for hardware scan offload")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zhao Li <enderaoelyther@xxxxxxxxx>
---
Validation: W=1 module builds with MODPOST passed with CONFIG_RSI_COEX
enabled and disabled. Not reproduced; RS9113/RS9116 hardware was
unavailable.
Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.

 drivers/net/wireless/rsi/rsi_91x_mac80211.c | 14 ++++++++------
 drivers/net/wireless/rsi/rsi_91x_mgmt.c     | 13 ++++++++-----
 drivers/net/wireless/rsi/rsi_mgmt.h         |  3 +--
 3 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 27bfdb6affaf..a2e981e261d6 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -237,6 +237,7 @@ static int rsi_mac80211_hw_scan_start(struct ieee80211_hw *hw,
 	struct cfg80211_scan_request *scan_req = &hw_req->req;
 	struct rsi_hw *adapter = hw->priv;
 	struct rsi_common *common = adapter->priv;
+	int ret;
 
 	rsi_dbg(INFO_ZONE, "***** Hardware scan start *****\n");
 	common->mac_ops_resumed = false;
@@ -260,15 +261,16 @@ static int rsi_mac80211_hw_scan_start(struct ieee80211_hw *hw,
 
 	mutex_lock(&common->mutex);
 	common->hwscan = scan_req;
-	if (!rsi_send_bgscan_params(common, RSI_START_BGSCAN)) {
-		if (!rsi_send_bgscan_probe_req(common, vif)) {
-			rsi_dbg(INFO_ZONE, "Background scan started...\n");
-			common->bgscan_en = true;
-		}
+	ret = rsi_start_bgscan(common, vif);
+	if (ret) {
+		common->hwscan = NULL;
+	} else {
+		rsi_dbg(INFO_ZONE, "Background scan started...\n");
+		common->bgscan_en = true;
 	}
 	mutex_unlock(&common->mutex);
 
-	return 0;
+	return ret;
 }
 
 static void rsi_mac80211_cancel_hw_scan(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
index 9ceb6cba3546..165423313c5f 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -1862,11 +1862,8 @@ int rsi_send_bgscan_params(struct rsi_common *common, int enable)
 	return rsi_send_internal_mgmt_frame(common, skb);
 }
 
-/* This function sends the probe request to be used by firmware in
- * background scan
- */
-int rsi_send_bgscan_probe_req(struct rsi_common *common,
-			      struct ieee80211_vif *vif)
+/* Send the firmware commands that start a background scan. */
+int rsi_start_bgscan(struct rsi_common *common, struct ieee80211_vif *vif)
 {
 	struct cfg80211_scan_request *scan_req = common->hwscan;
 	struct rsi_bgscan_probe *bgscan;
@@ -1875,6 +1872,7 @@ int rsi_send_bgscan_probe_req(struct rsi_common *common,
 	u16 frame_len = sizeof(*bgscan);
 	size_t ssid_len = 0;
 	u8 *ssid = NULL;
+	int ret;
 
 	rsi_dbg(MGMT_TX_ZONE,
 		"%s: Sending bgscan probe req frame\n", __func__);
@@ -1928,6 +1926,11 @@ int rsi_send_bgscan_probe_req(struct rsi_common *common,
 	skb_put(skb, frame_len + probereq_skb->len);
 
 	dev_kfree_skb(probereq_skb);
+	ret = rsi_send_bgscan_params(common, RSI_START_BGSCAN);
+	if (ret) {
+		dev_kfree_skb(skb);
+		return ret;
+	}
 
 	return rsi_send_internal_mgmt_frame(common, skb);
 }
diff --git a/drivers/net/wireless/rsi/rsi_mgmt.h b/drivers/net/wireless/rsi/rsi_mgmt.h
index 236b21482f38..6a4907e6bca9 100644
--- a/drivers/net/wireless/rsi/rsi_mgmt.h
+++ b/drivers/net/wireless/rsi/rsi_mgmt.h
@@ -753,6 +753,5 @@ int rsi_send_ps_request(struct rsi_hw *adapter, bool enable,
 			struct ieee80211_vif *vif);
 void init_bgscan_params(struct rsi_common *common);
 int rsi_send_bgscan_params(struct rsi_common *common, int enable);
-int rsi_send_bgscan_probe_req(struct rsi_common *common,
-			      struct ieee80211_vif *vif);
+int rsi_start_bgscan(struct rsi_common *common, struct ieee80211_vif *vif);
 #endif
-- 
2.56.0