Re: [PATCH wireless] wifi: ath12k: avoid flushing scan work under the wiphy lock
Jeff Johnson <[email protected]>
| Newsgroups | org.infradead.lists.ath12k,org.kernel.vger.linux-kernel,org.kernel.vger.linux-wireless,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On 6/11/2026 8:27 PM, Runyu Xiao wrote:
> ath12k_mac_op_stop() is entered with the wiphy mutex already held. It
> then takes ah->hw_mutex and ath12k_mac_stop() synchronously cancels the
> scan.timeout delayed work. The timeout worker grabs the same wiphy lock
> before it aborts the scan, so stop can deadlock against the pending
> worker.
>
> This issue was found by our static analysis tool and then manually
> reviewed against the current tree.
>
> The grounded PoC kept the ath12k_mac_op_stop() -> ath12k_mac_stop() ->
> cancel_delayed_work_sync(&ar->scan.timeout) path and the
> ath12k_scan_timeout_work() -> wiphy_lock() edge. Lockdep reported:
>
> WARNING: possible circular locking dependency detected
> ath12k_scan_timeout_work+0x25/0x42 [vuln_msv]
> __cancel_work_timer
> *** DEADLOCK ***
>
> Drain scan.timeout before re-entering the stop path under the wiphy lock
> and leave the rest of ath12k_mac_stop() unchanged.
>
> Fixes: 2830bc9e784f ("wifi: ath12k: implement remain on channel for P2P mode")
> Cc: [email protected]
> Signed-off-by: Runyu Xiao <[email protected]>
This patch does not apply against the current ath.git tree, please rebase.
tag ath-current instead of wireless when you post v2
/jeff