For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH test v2] wifi: mac80211: acquire wiphy lock for unlisted sdata teardown
Author: rajojha047@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 5f0c482..175965f 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -931,7 +931,7 @@ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
  * core when cfg80211 couldn't move it out of a network namespace that's being
  * destroyed. Drop it from the interface list either way.
  */
-static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data *sdata)
+static bool ieee80211_unlist_sdata(struct ieee80211_sub_if_data *sdata)
 {
 	struct ieee80211_local *local = sdata->local;
 	struct ieee80211_sub_if_data *iter;
@@ -943,16 +943,25 @@ static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data *sdata)
 			continue;
 		guard(mutex)(&local->iflist_mtx);
 		list_del_rcu(&sdata->list);
-		return;
+		return true;
 	}
+
+	return false;
 }
 
 static void ieee80211_uninit(struct net_device *dev)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+	struct wiphy *wiphy = sdata->local->hw.wiphy;
+	bool unlisted = ieee80211_unlist_sdata(sdata);
+
+	if (unlisted)
+		wiphy_lock(wiphy);
 
-	ieee80211_unlist_sdata(sdata);
 	ieee80211_teardown_sdata(sdata);
+
+	if (unlisted)
+		wiphy_unlock(wiphy);
 }
 
 static int ieee80211_netdev_setup_tc(struct net_device *dev,