mac80211_hwsim_free() removes each radio from hwsim_radios before calling mac80211_hwsim_del_radio(), but leaves the matching hwsim_radios_rht entry in place until the whole table is destroyed. Other radio removal paths remove both the list entry and data->rht while holding hwsim_radio_lock, before dropping the lock and deleting the radio. Do the same here so the all-radio cleanup path follows the same object visibility ordering. This helper is used while all radios are being torn down, either after callback users have already been unregistered or while module init is unwinding, so no hwsim_radios_generation update is needed. Assisted-by: Codex:gpt-5.5 Signed-off-by: Cen Zhang --- v2: - Reword as a small cleanup rather than a sanitizer/race report. - Do not update hwsim_radios_generation while all radios are being torn down. - Drop the Fixes tag from v1. drivers/net/wireless/virtual/mac80211_hwsim_main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c index 0dd8a6c85953..5c59c1a8e720 100644 --- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c +++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c @@ -6274,6 +6274,8 @@ static void mac80211_hwsim_free(void) struct mac80211_hwsim_data, list))) { list_del(&data->list); + rhashtable_remove_fast(&hwsim_radios_rht, &data->rht, + hwsim_rht_params); spin_unlock_bh(&hwsim_radio_lock); mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy), NULL); -- 2.43.0