cfg80211_process_wiphy_works() currently tries to recover from a runaway drain by reinitializing rdev->wiphy_work_list. That avoids walking the list any further, but it can strand valid owner-embedded work entries with stale list links. Trying to fix that by walking the remaining list is not safe either, because the guard may have fired after list corruption or accidental work reinitialization. Stop trying to recover from this state. Raise the limit to 30000 iterations so ordinary long drains have much more headroom, and BUG() if the guard still fires. At that point the code cannot reliably tell a self-requeueing work loop from a corrupted list, and continuing risks either silently losing work or touching corrupted links. Fixes: a3ee4dc84c4e ("wifi: cfg80211: add a work abstraction with special semantics") Assisted-by: Codex:gpt-5.5 Signed-off-by: Cen Zhang --- v2: - Raise the runaway limit to 30000 and BUG() if it is still hit. - Drop the per-entry drain so the fallback does not walk a possibly corrupted list. net/wireless/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/wireless/core.c b/net/wireless/core.c index 3dcf63b04c41..9a4d022f8838 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1256,7 +1256,7 @@ EXPORT_SYMBOL(wiphy_rfkill_start_polling); void cfg80211_process_wiphy_works(struct cfg80211_registered_device *rdev, struct wiphy_work *end) { - unsigned int runaway_limit = 100; + unsigned int runaway_limit = 30000; unsigned long flags; lockdep_assert_held(&rdev->wiphy.mtx); @@ -1278,8 +1278,8 @@ void cfg80211_process_wiphy_works(struct cfg80211_registered_device *rdev, if (wk == end) break; - if (WARN_ON(--runaway_limit == 0)) - INIT_LIST_HEAD(&rdev->wiphy_work_list); + if (--runaway_limit == 0) + BUG(); } spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags); } -- 2.43.0