------------[ cut here ]------------ WARNING: net/mac80211/tx.c:6509 at ieee80211_tx_skb_tid+0x3a4/0x44c net/mac80211/tx.c:6509, CPU#1: kworker/u8:6/1182 Modules linked in: CPU: 1 UID: 0 PID: 1182 Comm: kworker/u8:6 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Workqueue: netns cleanup_net pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : ieee80211_tx_skb_tid+0x3a4/0x44c net/mac80211/tx.c:6509 lr : ieee80211_tx_skb_tid+0x3a4/0x44c net/mac80211/tx.c:6509 sp : ffff800093ea6d90 x29: ffff800093ea6d90 x28: 0000000000000006 x27: ffff0000eaeccd6c x26: 0000000000000000 x25: dfff800000000000 x24: 0000000000000001 x23: 0000000000000000 x22: ffff0000f3608ec0 x21: 0000000000000007 x20: 00000000ffffffff x19: ffff0000ef7a0640 x18: 00000000ffffffff x17: 0000000000000003 x16: ffff800088bf7000 x15: ffff800082f592f8 x14: 0000000000000001 x13: 0000000000000009 x12: 0000000000000000 x11: 0000000000f140b4 x10: 0000000000000003 x9 : 0000000000000200 x8 : 0000000000000000 x7 : ffff8000862f56f4 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000862f58ac x2 : 0000000000000001 x1 : ffff0000c82bd880 x0 : 0000000000000000 Call trace: ieee80211_tx_skb_tid+0x3a4/0x44c net/mac80211/tx.c:6509 (P) ieee80211_tx_skb net/mac80211/ieee80211_i.h:2497 [inline] mesh_plink_frame_tx+0x5ec/0xa70 net/mac80211/mesh_plink.c:352 mesh_plink_deactivate+0x128/0x284 net/mac80211/mesh_plink.c:408 mesh_sta_cleanup+0x44/0x80 net/mac80211/mesh.c:173 __cleanup_single_sta net/mac80211/sta_info.c:167 [inline] cleanup_single_sta+0x354/0x4d4 net/mac80211/sta_info.c:192 __sta_info_destroy_part2+0x304/0x3d8 net/mac80211/sta_info.c:1615 __sta_info_flush+0x4c0/0x5f0 net/mac80211/sta_info.c:1744 sta_info_flush net/mac80211/sta_info.h:984 [inline] ieee80211_do_stop+0x350/0x1bf0 net/mac80211/iface.c:535 ieee80211_stop+0x1ac/0x1fc net/mac80211/iface.c:868 __dev_close_many+0x2f4/0x648 net/core/dev.c:1798 netif_close_many+0x1d8/0x51c net/core/dev.c:1824 netif_close+0x150/0x208 net/core/dev.c:1842 dev_close+0xf8/0x1dc net/core/dev_api.c:221 cfg80211_shutdown_all_interfaces+0xa4/0x234 net/wireless/core.c:364 ieee80211_remove_interfaces+0xf8/0x568 net/mac80211/iface.c:2465 ieee80211_unregister_hw+0x60/0x288 net/mac80211/main.c:1717 mac80211_hwsim_del_radio+0x214/0x304 drivers/net/wireless/virtual/mac80211_hwsim_main.c:6251 hwsim_exit_net+0xd88/0xe4c drivers/net/wireless/virtual/mac80211_hwsim_main.c:7260 ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x3cc/0x81c net/core/net_namespace.c:253 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:706 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 irq event stamp: 925179 hardirqs last enabled at (925178): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (925178): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221 hardirqs last disabled at (925179): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445 softirqs last enabled at (925170): [] spin_unlock_bh include/linux/spinlock.h:407 [inline] softirqs last enabled at (925170): [] ieee80211_txq_purge+0x264/0x340 net/mac80211/tx.c:1575 softirqs last disabled at (925172): [] spin_lock_bh include/linux/spinlock.h:353 [inline] softirqs last disabled at (925172): [] mesh_plink_deactivate+0x70/0x284 net/mac80211/mesh_plink.c:403 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: net/mac80211/iface.c:538 at ieee80211_do_stop+0x17bc/0x1bf0 net/mac80211/iface.c:536, CPU#1: kworker/u8:6/1182 Modules linked in: CPU: 1 UID: 0 PID: 1182 Comm: kworker/u8:6 Tainted: G W L syzkaller #0 PREEMPT Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Workqueue: netns cleanup_net pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : ieee80211_do_stop+0x17bc/0x1bf0 net/mac80211/iface.c:536 lr : ieee80211_do_stop+0x17bc/0x1bf0 net/mac80211/iface.c:536 sp : ffff800093ea7140 x29: ffff800093ea7330 x28: ffff800093ea7200 x27: ffff0000f3630f60 x26: dfff800000000000 x25: 1fffe0001e6c158e x24: ffff0000f3608ec0 x23: ffff800093ea7220 x22: ffff0000f360ac70 x21: 0000000000000001 x20: dfff800000000000 x19: ffff0000f3609930 x18: 1fffe00035ba3828 x17: 0000000000000003 x16: ffff800088bf7000 x15: ffff800082f592f8 x14: ffff800082f55384 x13: 0000000000000009 x12: 0000000000000000 x11: 00000000d1b801a3 x10: 000000000000003f x9 : 0000000000000000 x8 : 0000000000000000 x7 : ffff80008620c6e8 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800086266770 x2 : 0000000000000001 x1 : ffff0000c82bd880 x0 : 0000000000000000 Call trace: ieee80211_do_stop+0x17bc/0x1bf0 net/mac80211/iface.c:536 (P) ieee80211_stop+0x1ac/0x1fc net/mac80211/iface.c:868 __dev_close_many+0x2f4/0x648 net/core/dev.c:1798 netif_close_many+0x1d8/0x51c net/core/dev.c:1824 netif_close+0x150/0x208 net/core/dev.c:1842 dev_close+0xf8/0x1dc net/core/dev_api.c:221 cfg80211_shutdown_all_interfaces+0xa4/0x234 net/wireless/core.c:364 ieee80211_remove_interfaces+0xf8/0x568 net/mac80211/iface.c:2465 ieee80211_unregister_hw+0x60/0x288 net/mac80211/main.c:1717 mac80211_hwsim_del_radio+0x214/0x304 drivers/net/wireless/virtual/mac80211_hwsim_main.c:6251 hwsim_exit_net+0xd88/0xe4c drivers/net/wireless/virtual/mac80211_hwsim_main.c:7260 ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x3cc/0x81c net/core/net_namespace.c:253 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:706 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 irq event stamp: 925710 hardirqs last enabled at (925709): [] kasan_quarantine_put+0xb4/0x1c4 mm/kasan/quarantine.c:234 hardirqs last disabled at (925710): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445 softirqs last enabled at (925660): [] spin_unlock_bh include/linux/spinlock.h:407 [inline] softirqs last enabled at (925660): [] mesh_path_flush_by_nexthop+0x108/0x124 net/mac80211/mesh_pathtbl.c:845 softirqs last disabled at (925658): [] spin_lock_bh include/linux/spinlock.h:353 [inline] softirqs last disabled at (925658): [] mesh_path_flush_by_nexthop+0x54/0x124 net/mac80211/mesh_pathtbl.c:840 ---[ end trace 0000000000000000 ]--- hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left allmulticast mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed IPVS: stop unused estimator thread 0... IPVS: stop unused estimator thread 0... netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0