[syzbot] [wireless?] INFO: task hung in ieee80211_register_hw (8)

[syzbot] [wireless?] INFO: task hung in ieee80211_register_hw (8)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    6f157f39d181 Merge branch 'remove-comma-after-sentinel-ent..
git tree:       net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=104ae601580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ba53f227359c9d59
dashboard link: https://syzkaller.appspot.com/bug?extid=c92af8613ad38696ff09
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=101bf105580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f30b26c34a47/disk-6f157f39.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/46a0f6146076/vmlinux-6f157f39.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5b4fc3fe5ab8/bzImage-6f157f39.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c92af8613ad38696ff09@syzkaller.appspotmail.com

INFO: task syz-executor:5765 blocked for more than 158 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22416 pid:5765  tgid:5765  ppid:5759   task_flags:0x400140 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5520 [inline]
 __schedule+0x17db/0x58f0 kernel/sched/core.c:7270
 __schedule_loop kernel/sched/core.c:7347 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7362
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7419
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821
 ieee80211_register_hw+0x3881/0x4a50 net/mac80211/main.c:1560
 mac80211_hwsim_new_radio+0x3258/0x56b0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:6138
 hwsim_new_radio_nl+0xd8b/0xf90 drivers/net/wireless/virtual/mac80211_hwsim_main.c:6957
 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: [PATCH] INFO: task hung in ieee80211_register_hw (8)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] INFO: task hung in ieee80211_register_hw (8)
Author: jchuang26@m.fudan.edu.cn

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 6f157f39d1812ac5efd113a29bff3799dcb3150c

Reported-by: syzbot+c92af8613ad38696ff09@syzkaller.appspotmail.com

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index 02b6d81cc..de3bfeaa3 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -7156,6 +7156,15 @@ static struct genl_family hwsim_genl_family __ro_after_init = {
 	.resv_start_op = HWSIM_CMD_REPORT_PMSR + 1, // match with __HWSIM_CMD_MAX
 	.mcgrps = hwsim_mcgrps,
 	.n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
+	/*
+	 * HWSIM_CMD_NEW_RADIO goes through ieee80211_register_hw(), which
+	 * acquires the RTNL mutex.  Without parallel_ops the generic netlink
+	 * core serializes all of these handlers with genl_mutex, so a task
+	 * would hold genl_mutex while waiting for RTNL and can deadlock with
+	 * code that holds RTNL and needs genl_mutex.  The radio list is
+	 * protected by hwsim_radio_lock, so the handlers can run in parallel.
+	 */
+	.parallel_ops = true,
 };
 
 static void remove_user_radios(u32 portid, int netgroup)

Forwarded: [PATCH] INFO: task hung in ieee80211_register_hw (8)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] INFO: task hung in ieee80211_register_hw (8)
Author: jchuang26@m.fudan.edu.cn

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master

Reported-by: syzbot+c92af8613ad38696ff09@syzkaller.appspotmail.com

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index 02b6d81cc..de3bfeaa3 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -7156,6 +7156,15 @@ static struct genl_family hwsim_genl_family __ro_after_init = {
 	.resv_start_op = HWSIM_CMD_REPORT_PMSR + 1, // match with __HWSIM_CMD_MAX
 	.mcgrps = hwsim_mcgrps,
 	.n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
+	/*
+	 * HWSIM_CMD_NEW_RADIO goes through ieee80211_register_hw(), which
+	 * acquires the RTNL mutex.  Without parallel_ops the generic netlink
+	 * core serializes all of these handlers with genl_mutex, so a task
+	 * would hold genl_mutex while waiting for RTNL and can deadlock with
+	 * code that holds RTNL and needs genl_mutex.  The radio list is
+	 * protected by hwsim_radio_lock, so the handlers can run in parallel.
+	 */
+	.parallel_ops = true,
 };
 
 static void remove_user_radios(u32 portid, int netgroup)

Forwarded: [PATCH] INFO: task hung in ieee80211_register_hw (8)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] INFO: task hung in ieee80211_register_hw (8)
Author: jchuang26@m.fudan.edu.cn

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git 6f157f39d1812ac5efd113a29bff3799dcb3150c

Reported-by: syzbot+c92af8613ad38696ff09@syzkaller.appspotmail.com

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index 02b6d81cc..de3bfeaa3 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -7156,6 +7156,15 @@ static struct genl_family hwsim_genl_family __ro_after_init = {
 	.resv_start_op = HWSIM_CMD_REPORT_PMSR + 1, // match with __HWSIM_CMD_MAX
 	.mcgrps = hwsim_mcgrps,
 	.n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
+	/*
+	 * HWSIM_CMD_NEW_RADIO goes through ieee80211_register_hw(), which
+	 * acquires the RTNL mutex.  Without parallel_ops the generic netlink
+	 * core serializes all of these handlers with genl_mutex, so a task
+	 * would hold genl_mutex while waiting for RTNL and can deadlock with
+	 * code that holds RTNL and needs genl_mutex.  The radio list is
+	 * protected by hwsim_radio_lock, so the handlers can run in parallel.
+	 */
+	.parallel_ops = true,
 };
 
 static void remove_user_radios(u32 portid, int netgroup)