-----Original Message-----
From: Intel-wired-lan <redacted> On Behalf
Of Stanislav Fomichev
Sent: Wednesday, March 18, 2026 4:03 PM
To: netdev@vger.kernel.org
Cc: davem@davemloft.net; edumazet@google.com; kuba@kernel.org;
pabeni@redhat.com; horms@kernel.org; corbet@lwn.net;
skhan@linuxfoundation.org; andrew+netdev@lunn.ch;
michael.chan@broadcom.com; pavan.chebbi@broadcom.com; Nguyen, Anthony
L [off-list ref]; Kitszel, Przemyslaw
[off-list ref]; saeedm@nvidia.com; tariqt@nvidia.com;
mbloch@nvidia.com; alexanderduyck@fb.com; kernel-team@meta.com;
johannes@sipsolutions.net; sd@queasysnail.net; jianbol@nvidia.com;
dtatulea@nvidia.com; sdf@fomichev.me; mohsin.bashr@gmail.com; Keller,
Jacob E [off-list ref]; willemb@google.com;
skhawaja@google.com; bestswngs@gmail.com; linux-doc@vger.kernel.org;
linux-kernel@vger.kernel.org; intel-wired-lan@lists.osuosl.org; linux-
rdma@vger.kernel.org; linux-wireless@vger.kernel.org; linux-
kselftest@vger.kernel.org; leon@kernel.org
Subject: [Intel-wired-lan] [PATCH net-next v2 02/13] wifi: cfg80211:
use __rtnl_unlock in nl80211_pre_doit

nl80211_pre_doit acquires rtnl_lock and then wiphy_lock, releasing
rtnl while keeping wiphy_lock held until post_doit. With the
introduction of rx_mode_wq and its flush in netdev_run_todo, calling
rtnl_unlock here creates a circular lock dependency:

  Chain exists of:
    (wq_completion)rx_mode_wq --> rtnl_mutex --> &rdev->wiphy.mtx

   Possible unsafe locking scenario:

         CPU0                    CPU1
         ----                    ----
    lock(&rdev->wiphy.mtx);
                                 lock(rtnl_mutex);
                                 lock(&rdev->wiphy.mtx);
    lock((wq_completion)rx_mode_wq);

Switch to __rtnl_unlock to skip netdev_run_todo in nl80211_pre_doit.
This seems safe because we run before the op.

Link:
http://lore.kernel.org/netdev/69b5ad67.a00a0220.3b25d1.001a.GAE@google
.com
Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
---
 net/wireless/nl80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index

2225f5d0b124..ce5f25d4c87e 100644

--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c

@@ -18192,7 +18192,7 @@ static int nl80211_pre_doit(const struct

genl_split_ops *ops,
 		__release(&rdev->wiphy.mtx);
 	}
 	if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
-		rtnl_unlock();
+		__rtnl_unlock();

 	return 0;
 out_unlock:
--
2.53.0