[PATCH wireless] wifi: ath12k: avoid flushing scan work under the wiphy lock

[Jeff Johnson]

On 6/11/2026 8:27 PM, Runyu Xiao wrote:
> ath12k_mac_op_stop() is entered with the wiphy mutex already held.  It
> then takes ah->hw_mutex and ath12k_mac_stop() synchronously cancels the
> scan.timeout delayed work.  The timeout worker grabs the same wiphy lock
> before it aborts the scan, so stop can deadlock against the pending
> worker.
> 
> This issue was found by our static analysis tool and then manually
> reviewed against the current tree.
> 
> The grounded PoC kept the ath12k_mac_op_stop() -> ath12k_mac_stop() ->
> cancel_delayed_work_sync(&ar->scan.timeout) path and the
> ath12k_scan_timeout_work() -> wiphy_lock() edge.  Lockdep reported:
> 
>   WARNING: possible circular locking dependency detected
>   ath12k_scan_timeout_work+0x25/0x42 [vuln_msv]
>   __cancel_work_timer
>   *** DEADLOCK ***
> 
> Drain scan.timeout before re-entering the stop path under the wiphy lock
> and leave the rest of ath12k_mac_stop() unchanged.
> 
> Fixes: 2830bc9e784f ("wifi: ath12k: implement remain on channel for P2P mode")
> Cc: stable at vger.kernel.org
> Signed-off-by: Runyu Xiao <runyu.xiao at seu.edu.cn>

This patch does not apply against the current ath.git tree, please rebase.
tag ath-current instead of wireless when you post v2

/jeff