[syzbot] WARNING in wiphy_delayed_work_cancel

[syzbot] WARNING in wiphy_delayed_work_cancel

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11cff979580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
dashboard link: https://syzkaller.appspot.com/bug?extid=e9cbd080a7801f06cf08
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1284d979580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e9cbd080a7801f06cf08@syzkaller.appspotmail.com

------------[ cut here ]------------
debug_locks && !(lock_is_held(&(&wiphy->mtx)->dep_map) != 0)
WARNING: net/wireless/core.c:1957 at wiphy_delayed_work_cancel+0x9a/0xb0 net/wireless/core.c:1957, CPU#3: kworker/u32:0/12
Modules linked in:
CPU: 3 UID: 0 PID: 12 Comm: kworker/u32:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:wiphy_delayed_work_cancel+0x9a/0xb0 net/wireless/core.c:1957
Code: e8 bb a8 fa f6 48 8d 7d 60 be ff ff ff ff e8 ed 85 b6 00 31 ff 41 89 c4 89 c6 e8 11 a3 fa f6 45 85 e4 75 bf e8 97 a8 fa f6 90 <0f> 0b 90 eb b4 48 c7 c7 84 8a 43 91 e8 45 7c 6d f7 eb 90 0f 1f 00
RSP: 0018:ffffc900000f7740 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802b5e18a8 RCX: 0000000000000000
RDX: ffff88801ee9cb00 RSI: ffffffff8b105939 RDI: ffff88801ee9cb00
RBP: ffff888103680740 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: ffff888103680f40 R15: ffff888103680f90
FS:  0000000000000000(0000) GS:ffff8880d5ea2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055979cdf8da8 CR3: 000000003e9c7000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 ieee80211_free_keys+0xcd/0x640 net/mac80211/key.c:1148
 ieee80211_teardown_sdata+0x54/0x250 net/mac80211/iface.c:906
 unregister_netdevice_many_notify+0x1407/0x2150 net/core/dev.c:12537
 unregister_netdevice_many net/core/dev.c:12589 [inline]
 default_device_exit_batch+0x907/0xbd0 net/core/dev.c:13288
 ops_exit_list net/core/net_namespace.c:206 [inline]
 ops_undo_list+0x363/0xab0 net/core/net_namespace.c:253
 cleanup_net+0x499/0x920 net/core/net_namespace.c:706
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
 process_scheduled_works kernel/workqueue.c:3470 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: [PATCH test] wifi: mac80211: acquire wiphy lock in ieee80211_uninit()

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH test] wifi: mac80211: acquire wiphy lock in ieee80211_uninit()
Author: rajojha047@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 842bfb4a7cb6..c011e40eb351 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -949,8 +949,13 @@ static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data *sdata)
 static void ieee80211_uninit(struct net_device *dev)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+	struct wiphy *wiphy = sdata->local->hw.wiphy;
 
 	ieee80211_unlist_sdata(sdata);
+
+	wiphy_lock(wiphy);
 	ieee80211_teardown_sdata(sdata);
+	wiphy_unlock(wiphy);
 }
 
 static int ieee80211_netdev_setup_tc(struct net_device *dev,

Forwarded: [PATCH test] wifi: mac80211: acquire wiphy lock in ieee80211_uninit()

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH test] wifi: mac80211: acquire wiphy lock in ieee80211_uninit()
Author: rajojha047@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 842bfb4a7cb6..c011e40eb351 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -950,9 +950,13 @@ static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data *sdata)
 static void ieee80211_uninit(struct net_device *dev)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+	struct wiphy *wiphy = sdata->local->hw.wiphy;
 
 	ieee80211_unlist_sdata(sdata);
+
+	wiphy_lock(wiphy);
 	ieee80211_teardown_sdata(sdata);
+	wiphy_unlock(wiphy);
 }
 
 static int ieee80211_netdev_setup_tc(struct net_device *dev,

Forwarded: [PATCH test v2] wifi: mac80211: acquire wiphy lock for unlisted sdata teardown

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH test v2] wifi: mac80211: acquire wiphy lock for unlisted sdata teardown
Author: rajojha047@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 5f0c482..175965f 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -931,7 +931,7 @@ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
  * core when cfg80211 couldn't move it out of a network namespace that's being
  * destroyed. Drop it from the interface list either way.
  */
-static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data *sdata)
+static bool ieee80211_unlist_sdata(struct ieee80211_sub_if_data *sdata)
 {
 	struct ieee80211_local *local = sdata->local;
 	struct ieee80211_sub_if_data *iter;
@@ -943,16 +943,25 @@ static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data *sdata)
 			continue;
 		guard(mutex)(&local->iflist_mtx);
 		list_del_rcu(&sdata->list);
-		return;
+		return true;
 	}
+
+	return false;
 }
 
 static void ieee80211_uninit(struct net_device *dev)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+	struct wiphy *wiphy = sdata->local->hw.wiphy;
+	bool unlisted = ieee80211_unlist_sdata(sdata);
+
+	if (unlisted)
+		wiphy_lock(wiphy);
 
-	ieee80211_unlist_sdata(sdata);
 	ieee80211_teardown_sdata(sdata);
+
+	if (unlisted)
+		wiphy_unlock(wiphy);
 }
 
 static int ieee80211_netdev_setup_tc(struct net_device *dev,