mutex_lock(&mvm->mutex);
 
-       if (mvm->scan_status != IWL_MVM_SCAN_NONE) {
-               IWL_DEBUG_SCAN(mvm,
-                              "SCHED SCAN request during internal scan - abort\n");
+       switch (mvm->scan_status) {
+       case IWL_MVM_SCAN_OS:
+               IWL_DEBUG_SCAN(mvm, "Stopping previous scan for sched_scan\n");
+               ret = iwl_mvm_cancel_scan(mvm);
+               if (ret) {
+                       ret = -EBUSY;
+                       goto out;
+               }
+
+               /*
+                * iwl_mvm_rx_scan_complete() will be called soon but will
+                * not reset the scan status as it won't be IWL_MVM_SCAN_OS
+                * any more since we queue the next scan immediately (below).
+                * We make sure it is called before the next scan starts by
+                * flushing the async-handlers work.
+                */
+               break;
+       case IWL_MVM_SCAN_NONE:
+               break;
+       default:
                ret = -EBUSY;
                goto out;
        }
        mvm->scan_status = IWL_MVM_SCAN_NONE;
 out:
        mutex_unlock(&mvm->mutex);
+       /* make sure to flush the Rx handler before the next scan arrives */
+       iwl_mvm_wait_for_async_handlers(mvm);
        return ret;
 }
 
 
                             struct iwl_device_cmd *cmd);
 int iwl_mvm_rx_scan_complete(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                             struct iwl_device_cmd *cmd);
-void iwl_mvm_cancel_scan(struct iwl_mvm *mvm);
+int iwl_mvm_cancel_scan(struct iwl_mvm *mvm);
 
 /* Scheduled scan */
 int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
 
        RX_HANDLER(EOSP_NOTIFICATION, iwl_mvm_rx_eosp_notif, false),
 
        RX_HANDLER(SCAN_REQUEST_CMD, iwl_mvm_rx_scan_response, false),
-       RX_HANDLER(SCAN_COMPLETE_NOTIFICATION, iwl_mvm_rx_scan_complete, false),
+       RX_HANDLER(SCAN_COMPLETE_NOTIFICATION, iwl_mvm_rx_scan_complete, true),
        RX_HANDLER(SCAN_OFFLOAD_COMPLETE,
                   iwl_mvm_rx_scan_offload_complete_notif, true),
        RX_HANDLER(MATCH_FOUND_NOTIFICATION, iwl_mvm_rx_sched_scan_results,
 
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_scan_complete_notif *notif = (void *)pkt->data;
 
+       lockdep_assert_held(&mvm->mutex);
+
        IWL_DEBUG_SCAN(mvm, "Scan complete: status=0x%x scanned channels=%d\n",
                       notif->status, notif->scanned_channels);
 
-       mvm->scan_status = IWL_MVM_SCAN_NONE;
+       if (mvm->scan_status == IWL_MVM_SCAN_OS)
+               mvm->scan_status = IWL_MVM_SCAN_NONE;
        ieee80211_scan_completed(mvm->hw, notif->status != SCAN_COMP_STATUS_OK);
 
        iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
        };
 }
 
-void iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
+int iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
 {
        struct iwl_notification_wait wait_scan_abort;
        static const u8 scan_abort_notif[] = { SCAN_ABORT_CMD,
        int ret;
 
        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
-               return;
+               return 0;
 
        if (iwl_mvm_is_radio_killed(mvm)) {
                ieee80211_scan_completed(mvm->hw, true);
                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
                mvm->scan_status = IWL_MVM_SCAN_NONE;
-               return;
+               return 0;
        }
 
        iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
                goto out_remove_notif;
        }
 
-       ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_abort, 1 * HZ);
-       if (ret)
-               IWL_ERR(mvm, "%s - failed on timeout\n", __func__);
-
-       return;
+       return iwl_wait_notification(&mvm->notif_wait, &wait_scan_abort, HZ);
 
 out_remove_notif:
        iwl_remove_notification(&mvm->notif_wait, &wait_scan_abort);
+       return ret;
 }
 
 int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,