[syzbot ci] Re: wifi: cfg80211/nl80211: Add NAN Data Path support

[syzbot ci <syzbot+cib67e7c99902d09fe@syzkaller.appspotmail.com>]

syzbot ci has tested the following series

[v1] wifi: cfg80211/nl80211: Add NAN Data Path support
https://lore.kernel.org/all/20260107132003.2291979-1-miriam.rachel.korenblit@intel.com
* [PATCH wireless-next 01/15] wifi: nl80211: refactor nl80211_parse_chandef
* [PATCH wireless-next 02/15] wifi: nl80211/cfg80211: support stations of non-netdev interfaces
* [PATCH wireless-next 03/15] wifi: cfg80211: refactor wiphy_suspend
* [PATCH wireless-next 04/15] wifi: nl80211: don't allow DFS channels for NAN
* [PATCH wireless-next 05/15] wifi: cfg80211: Add an API to configure local NAN schedule
* [PATCH wireless-next 06/15] wifi: cfg80211: store the chandefs used for NAN
* [PATCH wireless-next 07/15] wifi: cfg80211: make sure NAN chandefs are valid
* [PATCH wireless-next 08/15] wifi: cfg80211: add support for NAN data interface
* [PATCH wireless-next 09/15] wifi: cfg80211: separately store HT, VHT and HE capabilities for NAN
* [PATCH wireless-next 10/15] wifi: nl80211: add support for NAN stations
* [PATCH wireless-next 11/15] wifi: nl80211: define an API for configuring the NAN peer's schedule
* [PATCH wireless-next 12/15] wifi: cfg80211: allow ToDS=0/FromDS=0 data frames on NAN data interfaces
* [PATCH wireless-next 13/15] wifi: nl80211: allow reporting spurious NAN Data frames
* [PATCH wireless-next 14/15] wifi: cfg80211: support key installation on non-netdev wdevs
* [PATCH wireless-next 15/15] wifi: cfg80211: allow protected action frame TX for NAN

and found the following issue:
possible deadlock in cfg80211_leave

Full report is available here:
https://ci.syzbot.org/series/233ae6b9-f1a6-42ee-a9ad-23778617ac45

***

possible deadlock in cfg80211_leave

tree:      torvalds
URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux
base:      805f9a061372164d43ddef771d7cd63e3ba6d845
arch:      amd64
compiler:  Debian clang version 21.1.8 (++20251202083448+f68f64eb8130-1~exp1~20251202083504.46), Debian LLD 21.1.8
config:    https://ci.syzbot.org/builds/ef828e0d-7b43-4e85-a3b3-c8a39bcbb3c9/config
C repro:   https://ci.syzbot.org/findings/f7def9d9-24af-4952-b991-2e6c88f8fb50/c_repro
syz repro: https://ci.syzbot.org/findings/f7def9d9-24af-4952-b991-2e6c88f8fb50/syz_repro

============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
kworker/1:3/1286 is trying to acquire lock:
ffff888113640788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6552 [inline]
ffff888113640788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_leave+0x17e/0x240 net/wireless/core.c:1507

but task is already holding lock:
ffff888113640788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6552 [inline]
ffff888113640788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_destroy_ifaces+0x128/0x1e0 net/wireless/core.c:394

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&rdev->wiphy.mtx);
  lock(&rdev->wiphy.mtx);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

4 locks held by kworker/1:3/1286:
 #0: ffff888100075948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
 #0: ffff888100075948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340
 #1: ffffc90008c3fbc0 ((work_completion)(&rdev->destroy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
 #1: ffffc90008c3fbc0 ((work_completion)(&rdev->destroy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340
 #2: ffffffff8f714e88 (rtnl_mutex){+.+.}-{4:4}, at: cfg80211_destroy_iface_wk+0x19/0x30 net/wireless/core.c:424
 #3: ffff888113640788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6552 [inline]
 #3: ffff888113640788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_destroy_ifaces+0x128/0x1e0 net/wireless/core.c:394

stack backtrace:
CPU: 1 UID: 0 PID: 1286 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: events cfg80211_destroy_iface_wk
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041
 check_deadlock kernel/locking/lockdep.c:3093 [inline]
 validate_chain kernel/locking/lockdep.c:3895 [inline]
 __lock_acquire+0x253f/0x2cf0 kernel/locking/lockdep.c:5237
 lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868
 __mutex_lock_common kernel/locking/mutex.c:614 [inline]
 __mutex_lock+0x19f/0x1340 kernel/locking/mutex.c:776
 class_wiphy_constructor include/net/cfg80211.h:6552 [inline]
 cfg80211_leave+0x17e/0x240 net/wireless/core.c:1507
 cfg80211_destroy_ifaces+0x137/0x1e0 net/wireless/core.c:396
 cfg80211_destroy_iface_wk+0x21/0x30 net/wireless/core.c:425
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340
 worker_thread+0x89f/0xd90 kernel/workqueue.c:3421
 kthread+0x726/0x8b0 kernel/kthread.c:463
 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>


***

If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
  Tested-by: syzbot@syzkaller.appspotmail.com

---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.