Re: [PATCH wireless] wifi: mac80211: clear beaconing state in ieee80211_do_stop()

[Johannes Berg <johannes@sipsolutions.net>]

On Sun, 2026-06-28 at 23:13 +0900, Hojun Choi wrote:
> Following up with the concrete path, since the question is whether
> cfg80211_leave() already covers this. It does not for AP start failure:
> ieee80211_start_ap() sets enable_beacon before its fail-able steps, but
> its error path (cfg.c:1930) only releases the channel, never clearing it
> (unlike the IBSS/mesh paths), while cfg80211 leaves ap.beacon_interval at
> 0. A later interface-down then makes ___cfg80211_stop_ap() short-circuit
> (-ENOENT, net/wireless/ap.c:30) and skip the stop_ap clear, so
> ieee80211_do_stop() runs with enable_beacon still set. I could not get a
> driver to fail start_ap() there, so this is by inspection, not a
> reproducer.

How did syzbot hit it then?

> I can fold this into the commit message in a v2, or instead fix the
> producer by clearing enable_beacon on the start_ap() error path
> (mirroring IBSS/mesh) - whichever you prefer. I used do_stop() since
> you suggested it might need to clear that bit.

Who is "you" here? I guess not me?

It seems to me the cleanup paths make more sense though? This looks
really quite out-of-place in do_stop() I think, especially the
offchannel bit? How would that even happen?

johannes