CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: convert pmsrfreewk to wiphywork to fix deadlock

When a netlink socket that owns a PMSR session is closed, cfg80211releasepmsr() clears the request's nlportid and queues pmsrfreewk to call cfg80211pmsrprocessabort() asynchronously.

If the interface tears down concurrently, cfg80211pmsrwdevdown() is called under wiphylock and calls cancelworksync(&pmsrfreewk) to wait for any running work. The work function acquires wiphylock via guard(wiphy) before calling processabort.

This is a deadlock: wdevdown holds wiphylock and blocks inside cancelworksync(); pmsrfreewk blocks trying to acquire that same wiphylock. Neither thread can proceed.

The same deadlock is reachable from cfg80211leavelocked(), which calls cfg80211pmsrwdevdown() for all interface types under wiphylock.

Fix this by converting pmsrfreewk from a plain workstruct to a wiphywork. The wiphywork dispatcher holds wiphylock when running work items, so the explicit guard(wiphy) in the work function is no longer needed. wiphyworkcancel() can be called safely while holding wiphylock - since wiphylock prevents the work from running concurrently, wiphyworkcancel() never blocks, eliminating the deadlock.

Remove the cancelworksync() for pmsrfreewk from the NETDEVGOINGDOWN handler. cfg80211leave(), called unconditionally just before it, already cancels any pending work under wiphylock via wiphyworkcancel() inside cfg80211pmsrwdevdown().