From a79d7328ba193d759e3a11911e564de58b6d77db Mon Sep 17 00:00:00 2001 From: Raj Ojha Date: Sat, 3 Oct 2026 16:57:41 +0530 Subject: [PATCH] wifi: mac80211: acquire wiphy lock for unlisted sdata teardown When netdev registration fails or an interface cannot be moved out of a dying network namespace, the netdev core calls ->ndo_uninit() (ieee80211_uninit) with RTNL held. However, ieee80211_uninit() calls ieee80211_teardown_sdata() without holding wiphy_lock. During teardown, ieee80211_free_keys() invokes wiphy_delayed_work_cancel(), which triggers a lockdep warning: WARNING: CPU: 0 PID: 6112 at net/wireless/core.c:1839 wiphy_delayed_work_cancel+0x85/0xb0 ... Call Trace: ieee80211_free_keys+0x31a/0x3c0 net/mac80211/key.c:380 ieee80211_teardown_sdata+0x2b8/0x10f0 net/mac80211/iface.c:928 ieee80211_uninit+0x3f/0x50 net/mac80211/iface.c:954 rollback_registered_many+0xa5c/0xef0 net/core/dev.c:10065 In the normal deletion path (ieee80211_del_virtual_intf), both RTNL and wiphy_lock are held when ieee80211_teardown_sdata() runs, and the sdata is removed from local->interfaces. Change ieee80211_unlist_sdata() to return a boolean indicating whether the sdata was present in the list, and acquire wiphy_lock in ieee80211_uninit() only if the interface is actually being unlisted here. Reported-by: syzbot+e9cbd080a7801f06cf08@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e9cbd080a7801f06cf08 Tested-by: syzbot+e9cbd080a7801f06cf08@syzkaller.appspotmail.com Signed-off-by: Raj Ojha Link: https://patch.msgid.link/20261003112741.52-1-rajojha047@gmail.com [dissolve ieee80211_unlist_sdata() to avoid weird locking] Signed-off-by: Johannes Berg --- net/mac80211/iface.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index d55f156555de..d0b0a503b229 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -927,32 +927,30 @@ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata) } } -/* - * The netdev can be unregistered without mac80211 doing it, e.g. by the netdev - * core when cfg80211 couldn't move it out of a network namespace that's being - * destroyed. Drop it from the interface list either way. - */ -static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data *sdata) +static void ieee80211_uninit(struct net_device *dev) { + struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); struct ieee80211_local *local = sdata->local; struct ieee80211_sub_if_data *iter; ASSERT_RTNL(); + /* + * The netdev can be unregistered without mac80211 doing it, e.g. by the + * netdev core when cfg80211 couldn't move it out of a network namespace + * that's being destroyed. If so, it's still listed and the wiphy mutex + * isn't held yet. + */ list_for_each_entry(iter, &local->interfaces, list) { if (iter != sdata) continue; - guard(mutex)(&local->iflist_mtx); - list_del_rcu(&sdata->list); + guard(wiphy)(local->hw.wiphy); + scoped_guard(mutex, &local->iflist_mtx) + list_del_rcu(&sdata->list); + ieee80211_teardown_sdata(sdata); return; } -} -static void ieee80211_uninit(struct net_device *dev) -{ - struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); - - ieee80211_unlist_sdata(sdata); ieee80211_teardown_sdata(sdata); }