On 12/10/2026 at 17:39:34 +0530, Aryan Arora [off-list ref] wrote:
Scan cleanup uses cancel_delayed_work(), which does not wait for a
running scan worker. The worker can requeue itself after cancellation,
leaving an active delayed-work timer when the PHY allocation is freed.
Cancel scan work synchronously before destroying the workqueue.
Fixes: 57588c71177f ("mac802154: Handle passive scanning")
Reported-by: syzbot+19cbce4cc656ecd4febc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=19cbce4cc656ecd4febc
Tested-by: syzbot+19cbce4cc656ecd4febc@syzkaller.appspotmail.com
Signed-off-by: Aryan Arora <redacted>
---
I thought this had already been fixed but apparently not.
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>