cfg80211_process_wiphy_works() has a runaway guard for the process-all case. When the guard fires, it drops the remaining queued work by reinitializing rdev->wiphy_work_list. That only resets the list head. The queued struct wiphy_work entries are embedded in their owners, and their entry fields still point at the old list neighbors. Later queue or cancel checks can then see a work item as listed even though the rdev list has been cleared. Drain the remaining list with list_del_init() under wiphy_work_lock instead of reinitializing only the head. This keeps the existing WARN and drop behavior while leaving each work item in the same state as normal wiphy work removal. Fixes: a3ee4dc84c4e ("wifi: cfg80211: add a work abstraction with special semantics") Assisted-by: Codex:gpt-5.5 Signed-off-by: Cen Zhang --- net/wireless/core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/net/wireless/core.c b/net/wireless/core.c index 3dcf63b04c41..a7e011ed455d 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1278,8 +1278,14 @@ void cfg80211_process_wiphy_works(struct cfg80211_registered_device *rdev, if (wk == end) break; - if (WARN_ON(--runaway_limit == 0)) - INIT_LIST_HEAD(&rdev->wiphy_work_list); + if (WARN_ON(--runaway_limit == 0)) { + while (!list_empty(&rdev->wiphy_work_list)) { + wk = list_first_entry(&rdev->wiphy_work_list, + struct wiphy_work, + entry); + list_del_init(&wk->entry); + } + } } spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags); } -- 2.43.0