[PATCH v2] wifi: cfg80211: BUG on runaway wiphy work drains

[Cen Zhang <zzzccc427@gmail.com>]

cfg80211_process_wiphy_works() currently tries to recover from a
runaway drain by reinitializing rdev->wiphy_work_list. That avoids
walking the list any further, but it can strand valid owner-embedded work
entries with stale list links. Trying to fix that by walking the
remaining list is not safe either, because the guard may have fired after
list corruption or accidental work reinitialization.

Stop trying to recover from this state. Raise the limit to 30000
iterations so ordinary long drains have much more headroom, and BUG() if
the guard still fires. At that point the code cannot reliably tell a
self-requeueing work loop from a corrupted list, and continuing risks
either silently losing work or touching corrupted links.

Fixes: a3ee4dc84c4e ("wifi: cfg80211: add a work abstraction with special semantics")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
v2:
- Raise the runaway limit to 30000 and BUG() if it is still hit.
- Drop the per-entry drain so the fallback does not walk a possibly
  corrupted list.

 net/wireless/core.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/wireless/core.c b/net/wireless/core.c
index 3dcf63b04c41..9a4d022f8838 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1256,7 +1256,7 @@ EXPORT_SYMBOL(wiphy_rfkill_start_polling);
 void cfg80211_process_wiphy_works(struct cfg80211_registered_device *rdev,
 				  struct wiphy_work *end)
 {
-	unsigned int runaway_limit = 100;
+	unsigned int runaway_limit = 30000;
 	unsigned long flags;
 
 	lockdep_assert_held(&rdev->wiphy.mtx);
@@ -1278,8 +1278,8 @@ void cfg80211_process_wiphy_works(struct cfg80211_registered_device *rdev,
 		if (wk == end)
 			break;
 
-		if (WARN_ON(--runaway_limit == 0))
-			INIT_LIST_HEAD(&rdev->wiphy_work_list);
+		if (--runaway_limit == 0)
+			BUG();
 	}
 	spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags);
 }
-- 
2.43.0