The survey and join command callbacks defer to the scan_to_timer and
assoc_timer at 1 jiffy when the command fails, instead of calling
the timeout handler directly. The TODO comments in the original
code explicitly note this should be done.

Replace the _set_timer(..., 1) deferral with a direct function call
to rtw_scan_timeout_handler() and _rtw_join_timeout_handler().
Cancel the pending timer first with timer_delete_sync() to prevent
the original timeout from firing later and invoking the handler a
second time on already-cleaned-up state.

Both handlers use timer_container_of() to recover the adapter
pointer from the timer field, which resolves correctly whether
called from the timer subsystem or directly.

Signed-off-by: Jad Keskes <inasj268@gmail.com>
---
 drivers/staging/rtl8723bs/core/rtw_cmd.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_cmd.c b/drivers/staging/rtl8723bs/core/rtw_cmd.c
index c1185c25e..cf0a67aff 100644
--- a/drivers/staging/rtl8723bs/core/rtw_cmd.c
+++ b/drivers/staging/rtl8723bs/core/rtw_cmd.c
@@ -1793,8 +1793,8 @@ void rtw_survey_cmd_callback(struct adapter *padapter,  struct cmd_obj *pcmd)
 	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
 
 	if (pcmd->res != H2C_SUCCESS) {
-		/* TODO: cancel timer and do timeout handler directly... */
-		_set_timer(&pmlmepriv->scan_to_timer, 1);
+		timer_delete_sync(&pmlmepriv->scan_to_timer);
+		rtw_scan_timeout_handler(&pmlmepriv->scan_to_timer);
 	}
 
 	/*  free cmd */
@@ -1821,8 +1821,8 @@ void rtw_joinbss_cmd_callback(struct adapter *padapter,  struct cmd_obj *pcmd)
 	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
 
 	if (pcmd->res != H2C_SUCCESS) {
-		/* TODO: cancel timer and do timeout handler directly... */
-		_set_timer(&pmlmepriv->assoc_timer, 1);
+		timer_delete_sync(&pmlmepriv->assoc_timer);
+		_rtw_join_timeout_handler(&pmlmepriv->assoc_timer);
 	}
 
 	rtw_free_cmd_obj(pcmd);
-- 
2.54.0