Scan cleanup uses cancel_delayed_work(), which does not wait for a running scan worker. The worker can requeue itself after cancellation, leaving an active delayed-work timer when the PHY allocation is freed. Cancel scan work synchronously before destroying the workqueue. Fixes: 57588c71177f ("mac802154: Handle passive scanning") Reported-by: syzbot+19cbce4cc656ecd4febc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=19cbce4cc656ecd4febc Tested-by: syzbot+19cbce4cc656ecd4febc@syzkaller.appspotmail.com Signed-off-by: Aryan Arora --- syzbot reproduced no crash on 7.3-rc7 with the PIB teardown patch [1] applied (base 08fa34e14e2d). Test log: https://syzkaller.appspot.com/x/bisect.txt?x=128c8f15580000 [1] https://lore.kernel.org/all/20260627235805.17310-1-alhouseenyousef@gmail.com/#t net/mac802154/main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/mac802154/main.c b/net/mac802154/main.c index ea1efef3572a..5a2ab501244b 100644 --- a/net/mac802154/main.c +++ b/net/mac802154/main.c @@ -283,6 +283,8 @@ void ieee802154_unregister_hw(struct ieee802154_hw *hw) rtnl_unlock(); + cancel_delayed_work_sync(&local->scan_work); + destroy_workqueue(local->mac_wq); destroy_workqueue(local->workqueue); wpan_phy_unregister(local->phy);