Re: [PATCH] wifi: nl80211: serialize socket owner release with netdev teardown

[Johannes Berg]

On Sat, 2026-06-20 at 00:25 +0800, Cen Zhang wrote:
> NETDEV_GOING_DOWN tears the interface down and cancels disconnect_wk, and
> NETDEV_UNREGISTER removes the wireless device from the cfg80211 list. There
> is no ordering between those paths today,

What's that supposed to mean? Of course there's ordering between those
two things?

> so the netlink notifier can pass
> the conn_owner_nlportid check before teardown clears it, then queue
> disconnect_wk after the NETDEV_GOING_DOWN cancel has already returned.

Yeah I guess that seems like it could happen.

> Take RTNL while the notifier walks cfg80211 devices and schedules owner
> cleanup work. Netdevice notifier delivery already runs under RTNL, so the
> schedule and cancel are ordered: either the work is queued before
> NETDEV_GOING_DOWN and the existing cancel drains it, or teardown runs first
> and the notifier no longer queues work for that connection owner.

That seems a bit over the top vs. just moving the cancel - why is this
the only correct fix?

johannes