nxpwifi_scan_networks() tests adapter->scan_processing without holding any lock and only sets it later under nxpwifi_cmd_lock. The test and the set are not atomic, so two callers can both observe the flag clear and both start a scan. This is reachable because the function has two callers in different contexts: nxpwifi_cfg80211_scan() runs under the wiphy mutex, while nxpwifi_active_scan_req_for_passive_chan() runs from the driver's main work via nxpwifi_check_next_scan_command(), which is not serialized against cfg80211 ops. After the last scan command completes, nxpwifi_check_next_scan_command() clears scan_processing and then starts the follow-up hidden SSID scan; a scan request from user space arriving in that window passes the unlocked check as well. Both scans then queue commands on scan_pending_q and share priv->scan_request, so one can clear scan_processing or call cfg80211_scan_done() while the other is still running. Move the scan_processing check under nxpwifi_cmd_lock, in the same critical section that sets it, so that test and set are atomic. Signed-off-by: Vishal Gupta --- drivers/net/wireless/nxp/nxpwifi/scan.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/nxp/nxpwifi/scan.c b/drivers/net/wireless/nxp/nxpwifi/scan.c index f3becafb9c23c..548c257a2e3c3 100644 --- a/drivers/net/wireless/nxp/nxpwifi/scan.c +++ b/drivers/net/wireless/nxp/nxpwifi/scan.c @@ -1336,12 +1336,6 @@ int nxpwifi_scan_networks(struct nxpwifi_private *priv, u8 scan_current_chan_only; u8 max_chan_per_scan; - if (adapter->scan_processing) { - nxpwifi_dbg(adapter, WARN, - "cmd: Scan already in process...\n"); - return -EBUSY; - } - if (priv->scan_block) { nxpwifi_dbg(adapter, WARN, "cmd: Scan is blocked during association...\n"); @@ -1356,6 +1350,12 @@ int nxpwifi_scan_networks(struct nxpwifi_private *priv, } spin_lock_bh(&adapter->nxpwifi_cmd_lock); + if (adapter->scan_processing) { + spin_unlock_bh(&adapter->nxpwifi_cmd_lock); + nxpwifi_dbg(adapter, WARN, + "cmd: Scan already in process...\n"); + return -EBUSY; + } adapter->scan_processing = true; spin_unlock_bh(&adapter->nxpwifi_cmd_lock); -- 2.43.0