quoted

The premise seems fairly reasonable, although I'm a little worried
that if so much new traffic is coming in we never finish the scan
suspend? Actually, the queues are still stopped, so it's only
management frames that can come in, so that should be ok?

Actually it will finish scan eventually and back to SCAN_DECISION
state but almost 20~30 seconds elapsed. The local->scanning should be
cleared after all channels been scanned. However, from the debug
messages I added in ieee80211_iface_work(), it still returns when
check local->scanning and the DELBA still has no chance to be
transferred then stuck again at the next scan state machine. Supposed
to be another scan request issued but I don't know who's the killer.
Except to find who issue the next scan request, BA session have no
chance to reset in this long scan period (>20s) still need to be
taken
care.

No no, you misunderstood. My question is more like:

Where is this traffic coming from, since netdev queues should be
stopped?

And then, if there's so much traffic coming in that we can take 20-30
seconds to send it out, could we - with the change - get stuck forever?

You're right. I just want to clear_bit and set_bit in this case,
sorry for that confusing. Or any better suggestion?

We seem to be using set_bit/clear_bit so that seems reasonable, unless
you can prove that all of those are under the lock and we can remove
the atomics entirely ... Not that it matters hugely, we don't scan all
the time after all!

johannes