linux-kernel - Re: [syzbot] Re: possible deadlock in team_del

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <68249828.a00a0220.104b28.000e.GAE@google.com>
Date: Wed, 14 May 2025 06:18:32 -0700
From: syzbot <syzbot+705c61d60b091ef42c04@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org
Subject: Re: [syzbot] Re: possible deadlock in team_del_slave (3)

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: Re: possible deadlock in team_del_slave (3)
Author: penguin-kernel@...ove.sakura.ne.jp

#syz test

diff --git a/net/wireless/core.c b/net/wireless/core.c
index dcce326fdb8c..ad812d4be773 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1236,6 +1236,21 @@ void wiphy_rfkill_set_hw_state_reason(struct wiphy *wiphy, bool blocked,
 }
 EXPORT_SYMBOL(wiphy_rfkill_set_hw_state_reason);
 
+struct netdev_unregister_work {
+	struct work_struct work;
+	struct net_device *netdev;
+};
+
+static void cfg80211_unregister_netdevice_work(struct work_struct *work)
+{
+	struct netdev_unregister_work *w = container_of(work, struct netdev_unregister_work, work);
+
+	rtnl_lock();
+	unregister_netdevice(w->netdev);
+	rtnl_unlock();
+	kfree(w);
+}
+
 static void _cfg80211_unregister_wdev(struct wireless_dev *wdev,
 				      bool unregister_netdev)
 {
@@ -1252,8 +1267,14 @@ static void _cfg80211_unregister_wdev(struct wireless_dev *wdev,
 
 	if (wdev->netdev) {
 		sysfs_remove_link(&wdev->netdev->dev.kobj, "phy80211");
-		if (unregister_netdev)
-			unregister_netdevice(wdev->netdev);
+		if (unregister_netdev) {
+			struct netdev_unregister_work *w
+				= kmalloc(sizeof(*w), GFP_KERNEL | __GFP_NOFAIL);
+
+			INIT_WORK(&w->work, cfg80211_unregister_netdevice_work);
+			w->netdev = wdev->netdev;
+			schedule_work(&w->work);
+		}
 	}
 
 	list_del_rcu(&wdev->list);