[PATCH 1/3] mwifiex: solve kernel dump issue for debugfs command 'debug'

[PATCH 1/3] mwifiex: solve kernel dump issue for debugfs command 'debug'

[Bing Zhao]

From: Amitkumar Karwar <akarwar@marvell.com>

Issue is when card is reinserted (without unloading the driver),
"cat /debugfs/mwifiex/mlan0/debug" command gives kernel dump.

Actually while handling this command some elements of "struct
mwifiex_adapter *adapter"and "struct mwifiex_debug_info *info"
are read by adding structure address to element offset
and displayed them to console.
When the card is reinserted, mwifiex_dev_debugfs_init() function
is called and addresses used for reading those elements (which are
correct ones) are unnecessorily incremented by structure addresses.

Fixed this issue by using separate variable to store final address
while reading structure elements instead of incrementing same
variable.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
---
 drivers/net/wireless/mwifiex/debugfs.c |   16 +++++-----------
 1 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c
index 9d23c68..2b642f1 100644
--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -430,7 +430,11 @@ mwifiex_debug_read(struct file *file, char __user *ubuf,
 		p += sprintf(p, "%s=", d[i].name);
 
 		size = d[i].size / d[i].num;
-		addr = d[i].addr;
+
+		if (i < (num_of_items - 3))
+			addr = d[i].addr + (size_t) &info;
+		else /* The last 3 items are struct mwifiex_adapter variables */
+			addr = d[i].addr + (size_t) priv->adapter;
 
 		for (j = 0; j < d[i].num; j++) {
 			switch (size) {
@@ -2459,8 +2463,6 @@ MWIFIEX_DFS_FILE_READ_OPS(esuppmode);
 void
 mwifiex_dev_debugfs_init(struct mwifiex_private *priv)
 {
-	int i;
-
 	ENTER();
 
 	if (!mwifiex_dfs_dir || !priv)
@@ -2472,14 +2474,6 @@ mwifiex_dev_debugfs_init(struct mwifiex_private *priv)
 	if (!priv->dfs_dev_dir)
 		goto exit;
 
-	/* The last 3 items are struct mwifiex_adapter variables */
-	for (i = 0; i < num_of_items - 3; i++)
-		items[i].addr += (size_t) &info;
-
-	for (; i < num_of_items; i++)
-		items[i].addr += (size_t) priv->adapter;
-
-
 	MWIFIEX_DFS_ADD_FILE(info);
 	MWIFIEX_DFS_ADD_FILE(debug);
 	MWIFIEX_DFS_ADD_FILE(deepsleep);
-- 
1.7.0.2

[PATCH 2/3] mwifiex: remove set operation for debugfs command 'debug'

[Bing Zhao]

From: Amitkumar Karwar <akarwar@marvell.com>

Debugfs command 'debug' gives useful information for debugging
purpose. Since there is no use case of set operation for this
command, the support is removed.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
---
 drivers/net/wireless/mwifiex/debugfs.c   |   98 +-----------------------------
 drivers/net/wireless/mwifiex/main.h      |    4 -
 drivers/net/wireless/mwifiex/sta_ioctl.c |   44 -------------
 drivers/net/wireless/mwifiex/util.c      |   73 +----------------------
 4 files changed, 2 insertions(+), 217 deletions(-)

diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c
index 2b642f1..597cb26 100644
--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -510,102 +510,6 @@ exit:
 }
 
 /*
- * Proc debug file write handler.
- *
- * This function is called when the 'debug' file is opened for writing
- *
- * This function can be used to overwrite/set debug parameters. It does
- * not validate if a debug parameter can be changed or not. It just sends
- * the change request to firmware.
- */
-static ssize_t
-mwifiex_debug_write(struct file *file, const char __user *ubuf,
-		    size_t count, loff_t *ppos)
-{
-	struct mwifiex_private *priv =
-		(struct mwifiex_private *) file->private_data;
-	char *buf, *p, *p0, *p1, *p2;
-	struct mwifiex_debug_data *d = &items[0];
-	ssize_t ret = 0;
-	unsigned long val;
-	int i;
-
-	ENTER();
-
-	buf = kzalloc(count, GFP_KERNEL);
-	if (!buf) {
-		ret = -EFAULT;
-		goto exit;
-	}
-
-	if (copy_from_user(buf, ubuf, count)) {
-		kfree(buf);
-		PRINTM(MERROR, "%s: copy_from_user failed\n", __func__);
-		ret = -EFAULT;
-		goto exit;
-	}
-
-	for (p0 = buf, i = 0; i < num_of_items; i++) {
-		/* skip array */
-		if (d[i].num > 1)
-			continue;
-
-		do {
-			p = strstr(p0, d[i].name);
-			if (!p)
-				break;
-
-			p1 = strchr(p, '\n');
-			if (!p1)
-				break;
-
-			p0 = p1++;
-
-			p2 = strchr(p, '=');
-			if (!p2)
-				break;
-			p2++;
-
-			ret = strict_strtoul(p2, 0, &val);
-			if (ret < 0) {
-				PRINTM(MERROR, "strict_strtoul fail %d\n", ret);
-				ret = -EFAULT;
-			}
-
-			switch (d[i].size) {
-			case 1:
-				*((u8 *) d[i].addr) = (u8) val;
-				break;
-			case 2:
-				*((u16 *) d[i].addr) = (u16) val;
-				break;
-			case 4:
-				*((u32 *) d[i].addr) = (u32) val;
-				break;
-			case 8:
-				*((long long *) d[i].addr) = (long long) val;
-				break;
-			default:
-				break;
-			}
-		} while (1);
-	}
-
-	kfree(buf);
-
-	/* Set debug information */
-	if (mwifiex_set_debug_info(priv, MWIFIEX_PROC_WAIT, &info)) {
-		PRINTM(MERROR, "%s: mwifiex_set_debug_info\n", __func__);
-		ret = -EFAULT;
-		goto exit;
-	}
-
-	LEAVE();
-exit:
-	return count;
-}
-
-/*
  * Proc txaggrpio file write handler.
  *
  * This function is called when the 'txaggrprio' file is opened for writing
@@ -2434,7 +2338,7 @@ static const struct file_operations mwifiex_dfs_##name##_fops = {       \
 
 
 MWIFIEX_DFS_FILE_READ_OPS(info);
-MWIFIEX_DFS_FILE_OPS(debug);
+MWIFIEX_DFS_FILE_READ_OPS(debug);
 MWIFIEX_DFS_FILE_OPS(deepsleep);
 MWIFIEX_DFS_FILE_OPS(hscfg);
 MWIFIEX_DFS_FILE_OPS(amsduaggrctrl);
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 646cc55..f43372f 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -996,10 +996,6 @@ enum mwifiex_status mwifiex_get_debug_info(struct mwifiex_private *priv,
 					   u8 wait_option,
 					   struct mwifiex_debug_info
 					   *debug_info);
-enum mwifiex_status mwifiex_set_debug_info(struct mwifiex_private *priv,
-					   u8 wait_option,
-					   struct mwifiex_debug_info
-					   *debug_info);
 enum mwifiex_status mwifiex_disconnect(struct mwifiex_private *, u8, u8 *);
 enum mwifiex_status mwifiex_bss_start(struct mwifiex_private *priv,
 				      u8 wait_option,
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 4a13ccc..f1676bb 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -546,50 +546,6 @@ mwifiex_get_debug_info(struct mwifiex_private *priv, u8 wait_option,
 }
 
 /*
- * Sends IOCTL request to set debug information.
- *
- * This function allocates the IOCTL request buffer, fills it
- * with requisite parameters and calls the IOCTL handler.
- */
-enum mwifiex_status
-mwifiex_set_debug_info(struct mwifiex_private *priv, u8 wait_option,
-		       struct mwifiex_debug_info *debug_info)
-{
-	struct mwifiex_ioctl_req *req = NULL;
-	struct mwifiex_ds_get_info *info = NULL;
-	enum mwifiex_status status = MWIFIEX_STATUS_SUCCESS;
-
-	ENTER();
-
-	if (!debug_info) {
-		LEAVE();
-		return MWIFIEX_STATUS_FAILURE;
-	}
-
-	/* Allocate an IOCTL request buffer */
-	req = mwifiex_alloc_ioctl_req(sizeof(struct mwifiex_ds_get_info));
-	if (req == NULL) {
-		LEAVE();
-		return MWIFIEX_STATUS_FAILURE;
-	}
-
-	/* Fill request buffer */
-	info = (struct mwifiex_ds_get_info *) req->buffer;
-	info->sub_command = MWIFIEX_OID_GET_DEBUG_INFO;
-	memcpy(&info->param.debug_info, debug_info,
-	       sizeof(struct mwifiex_debug_info));
-	req->req_id = MWIFIEX_IOCTL_GET_INFO;
-	req->action = MWIFIEX_ACT_SET;
-
-	status = mwifiex_request_ioctl(priv, req, wait_option);
-
-	if (req && (status != MWIFIEX_STATUS_PENDING))
-		kfree(req);
-	LEAVE();
-	return status;
-}
-
-/*
  * Sends IOCTL request to get Host Sleep parameters.
  *
  * This function allocates the IOCTL request buffer, fills it
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index 9af28b3..9ef5b74 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -296,78 +296,7 @@ mwifiex_get_info_debug_info(struct mwifiex_adapter *adapter,
 
 	info = (struct mwifiex_ds_get_info *) ioctl_req->buffer;
 
-	if (ioctl_req->action == MWIFIEX_ACT_SET) {
-		memcpy(priv->wmm.packets_out,
-		       info->param.debug_info.packets_out,
-		       sizeof(priv->wmm.packets_out));
-		adapter->max_tx_buf_size =
-			(u16) info->param.debug_info.max_tx_buf_size;
-		adapter->tx_buf_size =
-			(u16) info->param.debug_info.tx_buf_size;
-		adapter->curr_tx_buf_size =
-			(u16) info->param.debug_info.curr_tx_buf_size;
-		adapter->ps_mode = info->param.debug_info.ps_mode;
-		adapter->ps_state = info->param.debug_info.ps_state;
-		adapter->is_deep_sleep = info->param.debug_info.is_deep_sleep;
-		adapter->pm_wakeup_card_req =
-			info->param.debug_info.pm_wakeup_card_req;
-		adapter->pm_wakeup_fw_try =
-			info->param.debug_info.pm_wakeup_fw_try;
-		adapter->is_hs_configured =
-			info->param.debug_info.is_hs_configured;
-		adapter->hs_activated = info->param.debug_info.hs_activated;
-
-		adapter->dbg.num_cmd_host_to_card_failure =
-			info->param.debug_info.num_cmd_host_to_card_failure;
-		adapter->dbg.num_cmd_sleep_cfm_host_to_card_failure =
-			info->param.debug_info.
-			num_cmd_sleep_cfm_host_to_card_failure;
-		adapter->dbg.num_tx_host_to_card_failure =
-			info->param.debug_info.num_tx_host_to_card_failure;
-		adapter->dbg.num_event_deauth =
-			info->param.debug_info.num_event_deauth;
-		adapter->dbg.num_event_disassoc =
-			info->param.debug_info.num_event_disassoc;
-		adapter->dbg.num_event_link_lost =
-			info->param.debug_info.num_event_link_lost;
-		adapter->dbg.num_cmd_deauth =
-			info->param.debug_info.num_cmd_deauth;
-		adapter->dbg.num_cmd_assoc_success =
-			info->param.debug_info.num_cmd_assoc_success;
-		adapter->dbg.num_cmd_assoc_failure =
-			info->param.debug_info.num_cmd_assoc_failure;
-		adapter->dbg.num_tx_timeout =
-			info->param.debug_info.num_tx_timeout;
-		adapter->dbg.num_cmd_timeout =
-			info->param.debug_info.num_cmd_timeout;
-		adapter->dbg.timeout_cmd_id =
-			info->param.debug_info.timeout_cmd_id;
-		adapter->dbg.timeout_cmd_act =
-			info->param.debug_info.timeout_cmd_act;
-		memcpy(adapter->dbg.last_cmd_id,
-		       info->param.debug_info.last_cmd_id,
-		       sizeof(adapter->dbg.last_cmd_id));
-		memcpy(adapter->dbg.last_cmd_act,
-		       info->param.debug_info.last_cmd_act,
-		       sizeof(adapter->dbg.last_cmd_act));
-		adapter->dbg.last_cmd_index =
-			info->param.debug_info.last_cmd_index;
-		memcpy(adapter->dbg.last_cmd_resp_id,
-		       info->param.debug_info.last_cmd_resp_id,
-		       sizeof(adapter->dbg.last_cmd_resp_id));
-		adapter->dbg.last_cmd_resp_index =
-			info->param.debug_info.last_cmd_resp_index;
-		memcpy(adapter->dbg.last_event,
-		       info->param.debug_info.last_event,
-		       sizeof(adapter->dbg.last_event));
-		adapter->dbg.last_event_index =
-			info->param.debug_info.last_event_index;
-
-		adapter->data_sent = info->param.debug_info.data_sent;
-		adapter->cmd_sent = info->param.debug_info.cmd_sent;
-		adapter->cmd_resp_received =
-			info->param.debug_info.cmd_resp_received;
-	} else {		/* MWIFIEX_ACT_GET */
+	if (ioctl_req->action == MWIFIEX_ACT_GET) {
 		memcpy(info->param.debug_info.packets_out,
 		       priv->wmm.packets_out,
 		       sizeof(priv->wmm.packets_out));
-- 
1.7.0.2

[PATCH 3/3] mwifiex: remove struct mwifiex_drv_timer and associated

[Bing Zhao]

The struct mwifiex_drv_timer and its allocations are unnecessary
as we can use struct timer_list directly. All stuff associated
with this structure also removed.

Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: Kiran Divekar <dkiran@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
---
 drivers/net/wireless/mwifiex/11n_rxreorder.c |   53 ++++----------------------
 drivers/net/wireless/mwifiex/cmdevt.c        |   19 +--------
 drivers/net/wireless/mwifiex/init.c          |   10 +----
 drivers/net/wireless/mwifiex/main.c          |   44 ++-------------------
 drivers/net/wireless/mwifiex/main.h          |    8 +--
 drivers/net/wireless/mwifiex/sta_event.c     |    3 +-
 drivers/net/wireless/mwifiex/util.h          |   32 ---------------
 7 files changed, 20 insertions(+), 149 deletions(-)

diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index 9d72135..8da7a29 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -185,16 +185,7 @@ mwifiex_11n_delete_rx_reorder_tbl_entry(struct mwifiex_private *priv,
 						  rx_reor_tbl_ptr->win_size)
 						 &(MAX_TID_VALUE - 1));
 
-	if (rx_reor_tbl_ptr->timer_context.timer) {
-		if (rx_reor_tbl_ptr->timer_context.timer_is_set) {
-			del_timer(&rx_reor_tbl_ptr->timer_context.timer->tl);
-			rx_reor_tbl_ptr->timer_context.timer->timer_is_canceled
-					= true;
-			rx_reor_tbl_ptr->timer_context.timer->time_period = 0;
-		}
-
-		kfree(rx_reor_tbl_ptr->timer_context.timer);
-	}
+	del_timer(&rx_reor_tbl_ptr->timer_context.timer);
 
 	PRINTM(MDAT_D, "Delete rx_reor_tbl_ptr: %p\n", rx_reor_tbl_ptr);
 	mwifiex_util_unlink_list(&priv->rx_reorder_tbl_ptr,
@@ -267,13 +258,12 @@ mwifiex_11n_find_last_seq_num(struct mwifiex_rx_reorder_tbl *rx_reorder_tbl_ptr)
  * them and then dumps the Rx reordering table.
  */
 static void
-mwifiex_flush_data(void *context)
+mwifiex_flush_data(unsigned long context)
 {
 	struct reorder_tmr_cnxt *reorder_cnxt =
 		(struct reorder_tmr_cnxt *) context;
 	int start_win;
 
-	reorder_cnxt->timer_is_set = false;
 	mwifiex_11n_display_tbl_ptr(reorder_cnxt->priv->adapter,
 				    reorder_cnxt->ptr);
 
@@ -363,27 +353,12 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 		PRINTM(MDAT_D, "Create ReorderPtr: %p\n", new_node);
 		new_node->timer_context.ptr = new_node;
 		new_node->timer_context.priv = priv;
-		new_node->timer_context.timer_is_set = false;
-
-		new_node->timer_context.timer =
-			kmalloc(sizeof(struct mwifiex_drv_timer), GFP_KERNEL);
-		if (!new_node->timer_context.timer) {
-			LEAVE();
-			return;
-		}
-		init_timer(&new_node->timer_context.timer->tl);
-		new_node->timer_context.timer->tl.function =
-				mwifiex_timer_handler;
-		new_node->timer_context.timer->tl.data = (unsigned long)
-				new_node->timer_context.timer;
 
-		new_node->timer_context.timer->timer_function =
+		init_timer(&new_node->timer_context.timer);
+		new_node->timer_context.timer.function =
 				mwifiex_flush_data;
-		new_node->timer_context.timer->function_context =
-				&new_node->timer_context;
-		new_node->timer_context.timer->timer_is_canceled = true;
-		new_node->timer_context.timer->time_period = 0;
-		new_node->timer_context.timer->timer_is_periodic = false;
+		new_node->timer_context.timer.data =
+				(unsigned long) &new_node->timer_context;
 
 		for (i = 0; i < win_size; ++i)
 			new_node->rx_reorder_ptr[i] = NULL;
@@ -556,21 +531,9 @@ mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
 		start_win = rx_reor_tbl_ptr->start_win;
 		win_size = rx_reor_tbl_ptr->win_size;
 		end_win = ((start_win + win_size) - 1) & (MAX_TID_VALUE - 1);
-		if (rx_reor_tbl_ptr->timer_context.timer_is_set) {
-			del_timer(&rx_reor_tbl_ptr->timer_context.timer->tl);
-			rx_reor_tbl_ptr->timer_context.timer->timer_is_canceled
-					= true;
-			rx_reor_tbl_ptr->timer_context.timer->time_period = 0;
-		}
-		rx_reor_tbl_ptr->timer_context.timer->timer_is_periodic
-					= false;
-		rx_reor_tbl_ptr->timer_context.timer->time_period
-					= MIN_FLUSH_TIMER_MS * win_size;
-		mod_timer(&rx_reor_tbl_ptr->timer_context.timer->tl, jiffies
+		del_timer(&rx_reor_tbl_ptr->timer_context.timer);
+		mod_timer(&rx_reor_tbl_ptr->timer_context.timer, jiffies
 			+ (MIN_FLUSH_TIMER_MS * win_size * HZ) / 1000);
-		rx_reor_tbl_ptr->timer_context.timer->timer_is_canceled
-					= false;
-		rx_reor_tbl_ptr->timer_context.timer_is_set = true;
 
 		PRINTM(MDAT_D, "TID %d, TA %02x:%02x:%02x:%02x:%02x:%02x\n",
 		       tid, ta[0], ta[1], ta[2], ta[3], ta[4], ta[5]);
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index cfdf206..1f70cef 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -312,13 +312,8 @@ mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
 	cmd_code &= HostCmd_CMD_ID_MASK;
 
 	/* Setup the timer after transmit command */
-	adapter->mwifiex_cmd_timer->timer_is_periodic = false;
-	adapter->mwifiex_cmd_timer->time_period = MWIFIEX_TIMER_10S;
-	mod_timer(&adapter->mwifiex_cmd_timer->tl,
+	mod_timer(&adapter->cmd_timer,
 		jiffies + (MWIFIEX_TIMER_10S * HZ) / 1000);
-	adapter->mwifiex_cmd_timer->timer_is_canceled = false;
-
-	adapter->cmd_timer_is_set = true;
 
 	ret = MWIFIEX_STATUS_SUCCESS;
 
@@ -905,14 +900,7 @@ mwifiex_process_cmdresp(struct mwifiex_adapter *adapter)
 	ENTER();
 
 	/* Now we got response from FW, cancel the command timer */
-	if (adapter->cmd_timer_is_set) {
-		/* Cancel command timeout timer */
-		del_timer(&adapter->mwifiex_cmd_timer->tl);
-		adapter->mwifiex_cmd_timer->timer_is_canceled = true;
-		adapter->mwifiex_cmd_timer->time_period = 0;
-		/* Cancel command timeout timer */
-		adapter->cmd_timer_is_set = false;
-	}
+	del_timer(&adapter->cmd_timer);
 
 	if (!adapter->curr_cmd || !adapter->curr_cmd->resp_buf) {
 		resp = (struct host_cmd_ds_command *) adapter->upld_buf;
@@ -1044,7 +1032,7 @@ done:
  * It will re-send the same command again.
  */
 void
-mwifiex_cmd_timeout_func(void *function_context)
+mwifiex_cmd_timeout_func(unsigned long function_context)
 {
 	struct mwifiex_adapter *adapter =
 		(struct mwifiex_adapter *) function_context;
@@ -1055,7 +1043,6 @@ mwifiex_cmd_timeout_func(void *function_context)
 
 	ENTER();
 
-	adapter->cmd_timer_is_set = false;
 	adapter->num_cmd_timeout++;
 	adapter->dbg.num_cmd_timeout++;
 	if (!adapter->curr_cmd) {
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index b7fdd18..7b0b10c 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -231,8 +231,6 @@ mwifiex_init_adapter(struct mwifiex_adapter *adapter)
 	adapter->event_received = false;
 	adapter->data_received = false;
 
-	adapter->cmd_timer_is_set = false;
-
 	adapter->surprise_removed = false;
 
 	adapter->hw_status = MWIFIEX_HW_STATUS_INITIALIZING;
@@ -358,13 +356,7 @@ mwifiex_free_adapter(struct mwifiex_adapter *adapter)
 	PRINTM(MINFO, "Free Command buffer\n");
 	mwifiex_free_cmd_buffer(adapter);
 
-	if (adapter->cmd_timer_is_set) {
-		/* Cancel command timeout timer */
-		del_timer(&adapter->mwifiex_cmd_timer->tl);
-		adapter->mwifiex_cmd_timer->timer_is_canceled = true;
-		adapter->mwifiex_cmd_timer->time_period = 0;
-		adapter->cmd_timer_is_set = false;
-	}
+	del_timer(&adapter->cmd_timer);
 
 	PRINTM(MINFO, "Free ScanTable\n");
 	kfree(adapter->scan_table);
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 4e1ac6f..6f03f95 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -148,23 +148,9 @@ mwifiex_register(void *card,
 		goto error;
 	}
 
-	/* Initialize timers */
-	adapter->mwifiex_cmd_timer =
-		kmalloc(sizeof(struct mwifiex_drv_timer), GFP_KERNEL);
-	if (!adapter->mwifiex_cmd_timer) {
-		LEAVE();
-		return MWIFIEX_STATUS_FAILURE;
-	}
-	init_timer(&adapter->mwifiex_cmd_timer->tl);
-	adapter->mwifiex_cmd_timer->tl.function = mwifiex_timer_handler;
-	adapter->mwifiex_cmd_timer->tl.data =
-			(unsigned long) adapter->mwifiex_cmd_timer;
-
-	adapter->mwifiex_cmd_timer->timer_function = mwifiex_cmd_timeout_func;
-	adapter->mwifiex_cmd_timer->function_context = adapter;
-	adapter->mwifiex_cmd_timer->timer_is_canceled = true;
-	adapter->mwifiex_cmd_timer->time_period = 0;
-	adapter->mwifiex_cmd_timer->timer_is_periodic = false;
+	init_timer(&adapter->cmd_timer);
+	adapter->cmd_timer.function = mwifiex_cmd_timeout_func;
+	adapter->cmd_timer.data = (unsigned long) adapter;
 
 	/* Return pointer of struct mwifiex_adapter */
 	*padapter = adapter;
@@ -173,18 +159,6 @@ mwifiex_register(void *card,
 error:
 	PRINTM(MINFO, "Leave mwifiex_register with error\n");
 
-	/* Free timers */
-	if (adapter->mwifiex_cmd_timer) {
-		if (!adapter->mwifiex_cmd_timer->timer_is_canceled
-			&& adapter->mwifiex_cmd_timer->time_period) {
-			PRINTM(MWARN, "mwifiex free timer w/o stop timer!\n");
-			del_timer(&adapter->mwifiex_cmd_timer->tl);
-			adapter->mwifiex_cmd_timer->timer_is_canceled = true;
-			adapter->mwifiex_cmd_timer->time_period = 0;
-		}
-		kfree(adapter->mwifiex_cmd_timer);
-	}
-
 	/* Free lock variables */
 	wlan_free_lock_list(adapter);
 	for (i = 0; i < MWIFIEX_MAX_BSS_NUM; i++)
@@ -215,17 +189,7 @@ mwifiex_unregister(struct mwifiex_adapter *adapter)
 
 	ENTER();
 
-	/* Free timers */
-	if (adapter->mwifiex_cmd_timer) {
-		if (!adapter->mwifiex_cmd_timer->timer_is_canceled
-			&& adapter->mwifiex_cmd_timer->time_period) {
-			PRINTM(MWARN, "mwifiex free timer w/o stop timer!\n");
-			del_timer(&adapter->mwifiex_cmd_timer->tl);
-			adapter->mwifiex_cmd_timer->timer_is_canceled = true;
-			adapter->mwifiex_cmd_timer->time_period = 0;
-		}
-		kfree(adapter->mwifiex_cmd_timer);
-	}
+	del_timer(&adapter->cmd_timer);
 
 	/* Free lock variables */
 	wlan_free_lock_list(adapter);
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index f43372f..8e9fb0b 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -462,8 +462,7 @@ struct mwifiex_tx_ba_stream_tbl {
 struct mwifiex_rx_reorder_tbl;
 
 struct reorder_tmr_cnxt {
-	struct mwifiex_drv_timer *timer;
-	u8 timer_is_set;
+	struct timer_list timer;
 	struct mwifiex_rx_reorder_tbl *ptr;
 	struct mwifiex_private *priv;
 };
@@ -576,8 +575,7 @@ struct mwifiex_adapter {
 	spinlock_t mwifiex_cmd_lock;
 	u32 num_cmd_timeout;
 	u16 last_init_cmd;
-	struct mwifiex_drv_timer *mwifiex_cmd_timer;
-	u8 cmd_timer_is_set;
+	struct timer_list cmd_timer;
 	struct mwifiex_list_head cmd_free_q;
 	struct mwifiex_list_head cmd_pending_q;
 	struct mwifiex_list_head scan_pending_q;
@@ -686,7 +684,7 @@ enum mwifiex_status mwifiex_prepare_cmd(struct mwifiex_private *priv,
 					u32 cmd_oid,
 					void *ioctl_buf, void *data_buf);
 
-void mwifiex_cmd_timeout_func(void *FunctionContext);
+void mwifiex_cmd_timeout_func(unsigned long function_context);
 
 enum mwifiex_status mwifiex_misc_ioctl_host_cmd(struct mwifiex_adapter
 						*adapter,
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index f4384d5..4cd4169 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -119,8 +119,7 @@ mwifiex_reset_connect_state(struct mwifiex_private *priv)
 	adapter->tx_lock_flag = false;
 	adapter->pps_uapsd_mode = false;
 
-	if (adapter->num_cmd_timeout && adapter->curr_cmd &&
-	    !adapter->cmd_timer_is_set) {
+	if (adapter->num_cmd_timeout && adapter->curr_cmd) {
 		LEAVE();
 		return;
 	}
diff --git a/drivers/net/wireless/mwifiex/util.h b/drivers/net/wireless/mwifiex/util.h
index 9996398..12ba9f9 100644
--- a/drivers/net/wireless/mwifiex/util.h
+++ b/drivers/net/wireless/mwifiex/util.h
@@ -149,36 +149,4 @@ mwifiex_util_free_list_head(struct mwifiex_list_head *head)
 	head->next = NULL;
 	head->prev = head->next;
 }
-
-struct mwifiex_drv_timer {
-	struct timer_list tl;
-	void (*timer_function) (void *context);
-	void *function_context;
-	u32 time_period;
-	u32 timer_is_periodic;
-	u32 timer_is_canceled;
-};
-
-/*
- * Timer handler.
- *
- * This function calls the timer callback function and reassigns the
- * timer if it is periodic.
- */
-static inline void
-mwifiex_timer_handler(unsigned long fcontext)
-{
-	struct mwifiex_drv_timer *timer = (struct mwifiex_drv_timer *) fcontext;
-
-	timer->timer_function(timer->function_context);
-
-	if (timer->timer_is_periodic) {
-		mod_timer(&timer->tl,
-			  jiffies + ((timer->time_period * HZ) / 1000));
-	} else {
-		timer->timer_is_canceled = true;
-		timer->time_period = 0;
-	}
-}
-
 #endif /* !_MWIFIEX_UTIL_H_ */
-- 
1.7.0.2