BACKPORT: mwifiex: use del_timer_sync instead of del_timer

Use SMP safe del_timer_sync instead of del_timer for cancelling
timers.

Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Conflicts:
	drivers/net/wireless-3.4/mwifiex/11n_rxreorder.c
	drivers/net/wireless-3.4/mwifiex/init.c
[Brian: dev_dbg() vs. mwifiex_dbg() context; also conflicts with
CHROMIUM version of upstream "mwifiex: restart rxreorder timer
correctly" -- the resolution matches upstream]

[wireless-3.8 -> wireless-3.4: dev_dbg() vs. mwifiex_dbg() again]

BUG=b:62836830
TEST=`iw mlan0 scan & sleep 0.5; echo 1 > /sys/kernel/debug/mwifiex/mlan0/reset`

Change-Id: Ie43dfeefa6fa76f57f94756419478a44c0628a79
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/588377
Reviewed-by: Dmitry Torokhov <dtor@chromium.org>
(cherry picked from commit 9fa06b7e4e6771b1abe76137c455530f7984c64b)
Reviewed-on: https://chromium-review.googlesource.com/765130
diff --git a/drivers/net/wireless-3.4/mwifiex/11n_rxreorder.c b/drivers/net/wireless-3.4/mwifiex/11n_rxreorder.c
index e8dd3b9..772c39d6 100644
--- a/drivers/net/wireless-3.4/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless-3.4/mwifiex/11n_rxreorder.c
@@ -134,7 +134,7 @@
 	mwifiex_11n_dispatch_pkt(priv, tbl, (tbl->start_win + tbl->win_size) &
 					    (MAX_TID_VALUE - 1));
 
-	del_timer(&tbl->timer_context.timer);
+	del_timer_sync(&tbl->timer_context.timer);
 	tbl->timer_context.timer_is_set = false;
 
 	spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
diff --git a/drivers/net/wireless-3.4/mwifiex/cmdevt.c b/drivers/net/wireless-3.4/mwifiex/cmdevt.c
index b61a74c..63f5ef9 100644
--- a/drivers/net/wireless-3.4/mwifiex/cmdevt.c
+++ b/drivers/net/wireless-3.4/mwifiex/cmdevt.c
@@ -707,7 +707,7 @@
 	unsigned long flags;
 
 	/* Now we got response from FW, cancel the command timer */
-	del_timer(&adapter->cmd_timer);
+	del_timer_sync(&adapter->cmd_timer);
 
 	if (!adapter->curr_cmd || !adapter->curr_cmd->resp_skb) {
 		resp = (struct host_cmd_ds_command *) adapter->upld_buf;
diff --git a/drivers/net/wireless-3.4/mwifiex/init.c b/drivers/net/wireless-3.4/mwifiex/init.c
index 6302a48..f06b274 100644
--- a/drivers/net/wireless-3.4/mwifiex/init.c
+++ b/drivers/net/wireless-3.4/mwifiex/init.c
@@ -700,7 +700,7 @@
 	/* cancel current command */
 	if (adapter->curr_cmd) {
 		dev_warn(adapter->dev, "curr_cmd is still in processing\n");
-		del_timer(&adapter->cmd_timer);
+		del_timer_sync(&adapter->cmd_timer);
 		mwifiex_recycle_cmd_node(adapter, adapter->curr_cmd);
 		adapter->curr_cmd = NULL;
 	}
diff --git a/drivers/net/wireless-3.4/mwifiex/main.c b/drivers/net/wireless-3.4/mwifiex/main.c
index d4f3d71..f95269d 100644
--- a/drivers/net/wireless-3.4/mwifiex/main.c
+++ b/drivers/net/wireless-3.4/mwifiex/main.c
@@ -121,7 +121,7 @@
 	if (adapter->if_ops.cleanup_if)
 		adapter->if_ops.cleanup_if(adapter);
 
-	del_timer(&adapter->cmd_timer);
+	del_timer_sync(&adapter->cmd_timer);
 
 	/* Free private structures */
 	for (i = 0; i < adapter->priv_num; i++) {