* [PATCH] mac802154: Cancel scan work synchronously during hardware teardown
@ 2026-10-12 12:09 Aryan Arora
2026-10-12 17:00 ` Miquel Raynal
0 siblings, 1 reply; 2+ messages in thread
From: Aryan Arora @ 2026-10-12 12:09 UTC (permalink / raw)
To: Alexander Aring, Stefan Schmidt, Miquel Raynal
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, David Girault, linux-wpan, netdev, linux-kernel,
syzbot+19cbce4cc656ecd4febc, Aryan Arora
Scan cleanup uses cancel_delayed_work(), which does not wait for a
running scan worker. The worker can requeue itself after cancellation,
leaving an active delayed-work timer when the PHY allocation is freed.
Cancel scan work synchronously before destroying the workqueue.
Fixes: 57588c71177f ("mac802154: Handle passive scanning")
Reported-by: syzbot+19cbce4cc656ecd4febc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=19cbce4cc656ecd4febc
Tested-by: syzbot+19cbce4cc656ecd4febc@syzkaller.appspotmail.com
Signed-off-by: Aryan Arora <aryanarora.w1@gmail.com>
---
syzbot reproduced no crash on 7.3-rc7 with the PIB teardown patch [1]
applied (base 08fa34e14e2d).
Test log: https://syzkaller.appspot.com/x/bisect.txt?x=128c8f15580000
[1] https://lore.kernel.org/all/20260627235805.17310-1-alhouseenyousef@gmail.com/#t
net/mac802154/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/mac802154/main.c b/net/mac802154/main.c
index ea1efef3572a..5a2ab501244b 100644
--- a/net/mac802154/main.c
+++ b/net/mac802154/main.c
@@ -283,6 +283,8 @@ void ieee802154_unregister_hw(struct ieee802154_hw *hw)
rtnl_unlock();
+ cancel_delayed_work_sync(&local->scan_work);
+
destroy_workqueue(local->mac_wq);
destroy_workqueue(local->workqueue);
wpan_phy_unregister(local->phy);
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] mac802154: Cancel scan work synchronously during hardware teardown
2026-10-12 12:09 [PATCH] mac802154: Cancel scan work synchronously during hardware teardown Aryan Arora
@ 2026-10-12 17:00 ` Miquel Raynal
0 siblings, 0 replies; 2+ messages in thread
From: Miquel Raynal @ 2026-10-12 17:00 UTC (permalink / raw)
To: Aryan Arora
Cc: Alexander Aring, Stefan Schmidt, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, David Girault,
linux-wpan, netdev, linux-kernel, syzbot+19cbce4cc656ecd4febc
On 12/10/2026 at 17:39:34 +0530, Aryan Arora <aryanarora.w1@gmail.com> wrote:
> Scan cleanup uses cancel_delayed_work(), which does not wait for a
> running scan worker. The worker can requeue itself after cancellation,
> leaving an active delayed-work timer when the PHY allocation is freed.
>
> Cancel scan work synchronously before destroying the workqueue.
>
> Fixes: 57588c71177f ("mac802154: Handle passive scanning")
> Reported-by: syzbot+19cbce4cc656ecd4febc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=19cbce4cc656ecd4febc
> Tested-by: syzbot+19cbce4cc656ecd4febc@syzkaller.appspotmail.com
> Signed-off-by: Aryan Arora <aryanarora.w1@gmail.com>
> ---
I thought this had already been fixed but apparently not.
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-12 17:00 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-12 12:09 [PATCH] mac802154: Cancel scan work synchronously during hardware teardown Aryan Arora
2026-10-12 17:00 ` Miquel Raynal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®