[v6.1] WARNING in ieee80211_do_stop

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: cf82dcca9634 Linux 6.1.187
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=101f96f9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=f007ee81bb3dd463adaf
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/425a730ba33a/disk-cf82dcca.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7dd95cb647d8/vmlinux-cf82dcca.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1b21aedea13f/Image-cf82dcca.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f007ee...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 8634 at net/mac80211/iface.c:532 ieee80211_do_stop+0xb2c/0x1ba0 net/mac80211/iface.c:532
Modules linked in:
CPU: 0 PID: 8634 Comm: syz.3.1093 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ieee80211_do_stop+0xb2c/0x1ba0 net/mac80211/iface.c:532
lr : ieee80211_do_stop+0xb2c/0x1ba0 net/mac80211/iface.c:532
sp : ffff8000215574c0
x29: ffff800021557690 x28: dfff800000000000 x27: ffff0000c6568e80
x26: dfff800000000000 x25: ffff0000f4f78000 x24: 0000000000000007
x23: ffff800021557580 x22: ffff0000f4f7a760 x21: 0000000000000001
x20: ffff7000042aaeac x19: ffff0000f4f78c80 x18: 1fffe00033e6df7e
x17: ffff80001539d000 x16: ffff800011ba0e90 x15: ffff8000089b6798
x14: 0000000000000001 x13: 1ffff000042aae60 x12: 0000000000080000
x11: 000000000007ffff x10: ffff8000297af000 x9 : ffff8000113f8ac8
x8 : 0000000000080000 x7 : ffff80000805a700 x6 : ffff80000805a910
x5 : ffff0001016efec0 x4 : ffff800021557008 x3 : ffff800011c77390
x2 : 0000000000000000 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
ieee80211_do_stop+0xb2c/0x1ba0 net/mac80211/iface.c:532
ieee80211_stop+0x398/0x400 net/mac80211/iface.c:815
__dev_close_many+0x2ac/0x3a0 net/core/dev.c:1585
dev_close_many+0x1e8/0x448 net/core/dev.c:1610
dev_close+0x150/0x208 net/core/dev.c:1636
cfg80211_shutdown_all_interfaces+0xb8/0x1c8 net/wireless/core.c:275
cfg80211_rfkill_set_block+0x30/0x50 net/wireless/core.c:307
rfkill_set_block+0x194/0x33c net/rfkill/core.c:360
rfkill_fop_write+0x488/0x5ac net/rfkill/core.c:1318
vfs_write+0x2a8/0x7c8 fs/read_write.c:582
ksys_write+0x12c/0x228 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 5512
hardirqs last enabled at (5511): [<ffff8000088f6370>] kasan_quarantine_put+0xc4/0x200 mm/kasan/quarantine.c:242
hardirqs last disabled at (5512): [<ffff800011b9d0cc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (5472): [<ffff80001156bc6c>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last enabled at (5472): [<ffff80001156bc6c>] mesh_path_flush_by_nexthop+0x108/0x124 net/mac80211/mesh_pathtbl.c:552
softirqs last disabled at (5470): [<ffff80001156bbb8>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (5470): [<ffff80001156bbb8>] mesh_path_flush_by_nexthop+0x54/0x124 net/mac80211/mesh_pathtbl.c:547
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 8b73de7da85f Linux 6.6.156
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1507f0c9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7be9809cedd6b69c
dashboard link: https://syzkaller.appspot.com/bug?extid=66b01a29a6b06bd64cd2

compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/d7e87682fef0/disk-8b73de7d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/096830afc063/vmlinux-8b73de7d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/89c175e4560d/bzImage-8b73de7d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+66b01a...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 1 PID: 7791 at net/mac80211/iface.c:530 ieee80211_do_stop+0x1ac8/0x2000 net/mac80211/iface.c:530
Modules linked in:
CPU: 1 PID: 7791 Comm: kworker/u4:25 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: netns cleanup_net
RIP: 0010:ieee80211_do_stop+0x1ac8/0x2000 net/mac80211/iface.c:530
Code: f7 49 81 c5 d8 06 00 00 4c 89 e8 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 e0 04 00 00 41 ff 4d 00 e9 ed f5 ff ff e8 98 b7 82 f7 <0f> 0b e9 d0 e8 ff ff e8 8c b7 82 f7 43 0f b6 04 27 84 c0 0f 85 f5
RSP: 0018:ffffc9001087f380 EFLAGS: 00010293
RAX: ffffffff8a04cad8 RBX: 0000000000000001 RCX: ffff88802bfe3c00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9001087f568 R08: ffffc9001087f227 R09: 1ffff9200210fe44
R10: dffffc0000000000 R11: fffff5200210fe45 R12: dffffc0000000000
R13: ffffc9001087f4d0 R14: 0000000000000001 R15: ffff88805cd56930
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cda5c3c950 CR3: 000000004ca6e000 CR4: 00000000003506e0
Call Trace:
<TASK>
ieee80211_stop+0x423/0x490 net/mac80211/iface.c:813
__dev_close_many+0x1d5/0x2b0 net/core/dev.c:1603
dev_close_many+0x220/0x410 net/core/dev.c:1628
dev_close+0x158/0x210 net/core/dev.c:1654
cfg80211_shutdown_all_interfaces+0xaf/0x1c0 net/wireless/core.c:280
ieee80211_remove_interfaces+0x114/0x690 net/mac80211/iface.c:2339
ieee80211_unregister_hw+0x5d/0x2a0 net/mac80211/main.c:1518
mac80211_hwsim_del_radio+0x289/0x480 drivers/net/wireless/virtual/mac80211_hwsim.c:5412
hwsim_exit_net+0x58d/0x650 drivers/net/wireless/virtual/mac80211_hwsim.c:6290
ops_exit_list net/core/net_namespace.c:173 [inline]
cleanup_net+0x707/0xbb0 net/core/net_namespace.c:652
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>