ieee80211_do_stop() zeroes vif.bss_conf.beacon_int but, unlike ieee80211_stop_ap(), ieee80211_ibss_disconnect() and ieee80211_stop_mesh(), leaves enable_beacon set and the SDATA_STATE_OFFCHANNEL_BEACON_STOPPED bit pending. cfg80211 rejects a beacon interval below 10, so a zero interval comes from this teardown, not from userspace. do_stop() clears SDATA_STATE_RUNNING first, so nothing acts on the stale state while the interface is down. But do_open() re-sets RUNNING without restoring beacon_int or clearing enable_beacon and the bit, so the state survives a down/up cycle. A later ieee80211_offchannel_return() on scan completion then consumes the stale bit and re-enables beaconing while beacon_int is still 0, and drivers arming a beacon timer from the interval divide by zero. syzbot reported this as a divide error in mac80211_hwsim_link_info_changed(); the exact sequence that leaves do_stop() with beaconing still enabled was not reproduced. Clear enable_beacon and the bit in ieee80211_do_stop() as well, mirroring the other teardown paths, so the state cannot outlive the interface. do_stop() warns on a vif that still has valid links, so MLD links are already torn down here and only the deflink beacon_int is zeroed; clearing the deflink enable_beacon is sufficient. Fixes: d6a83228823f ("mac80211: track enable_beacon explicitly") Reported-by: syzbot+ca7a2759caaa6cd4e3db@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ca7a2759caaa6cd4e3db Link: https://lore.kernel.org/all/20251205153502.273426-1-dkarn@redhat.com/ Signed-off-by: Hojun Choi --- net/mac80211/iface.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index 086272c3ec08..c070d47cb631 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -719,6 +719,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do sdata->vif.bss_conf.beacon_int = 0; + /* mirror stop_ap()/IBSS/mesh: also clear the beaconing state */ + sdata->vif.bss_conf.enable_beacon = false; + clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state); + /* * If the interface goes down while suspended, presumably because * the device was unplugged and that happens before our resume, -- 2.54.0