bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): (slave wlan1): Releasing backup interface
------------[ cut here ]------------
WARNING: net/mac80211/tx.c:6303 at ieee80211_tx_skb_tid+0x462/0x550 net/mac80211/tx.c:6303, CPU#2: kworker/u32:8/1147
Modules linked in:
CPU: 2 UID: 0 PID: 1147 Comm: kworker/u32:8 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:ieee80211_tx_skb_tid+0x462/0x550 net/mac80211/tx.c:6303
Code: fc ff ff e8 f0 ed 40 f7 e9 94 fc ff ff 4c 89 e7 e8 13 ee 40 f7 e9 53 fd ff ff e8 d9 ed 40 f7 e9 0b fe ff ff e8 cf 46 d8 f6 90 <0f> 0b 90 e8 d6 01 80 00 31 ff 89 c3 89 c6 e8 6b 41 d8 f6 85 db 75
RSP: 0018:ffffc90006f6ef08 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88804f304d80 RCX: ffffffff8ae564e0
RDX: ffff888027dc4980 RSI: ffffffff8ae56581 RDI: 0000000000000005
RBP: 00000000ffffffff R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 00000000dd426b56 R12: 0000000000000001
R13: ffff88806fbf7540 R14: 0000000000000007 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88809795b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000030223ffc CR3: 000000004b47f000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 ieee80211_tx_skb net/mac80211/ieee80211_i.h:2418 [inline]
 mesh_plink_frame_tx.isra.0+0x8a5/0xc60 net/mac80211/mesh_plink.c:354
 mesh_plink_deactivate+0x271/0x340 net/mac80211/mesh_plink.c:410
 mesh_sta_cleanup+0x35/0x70 net/mac80211/mesh.c:171
 __cleanup_single_sta+0x5c0/0x730 net/mac80211/sta_info.c:167
 cleanup_single_sta net/mac80211/sta_info.c:192 [inline]
 __sta_info_destroy_part2+0x389/0x540 net/mac80211/sta_info.c:1554
 __sta_info_flush+0x521/0x740 net/mac80211/sta_info.c:1683
 sta_info_flush net/mac80211/sta_info.h:970 [inline]
 ieee80211_do_stop+0x278/0x2520 net/mac80211/iface.c:526
 ieee80211_stop+0x169/0x320 net/mac80211/iface.c:828
 __dev_close_many+0x29b/0x700 net/core/dev.c:1756
 netif_close_many+0x233/0x630 net/core/dev.c:1781
 netif_close net/core/dev.c:1798 [inline]
 netif_close+0x17f/0x230 net/core/dev.c:1792
 dev_close+0xaa/0x240 net/core/dev_api.c:220
 __bond_release_one+0xb0c/0x1a40 drivers/net/bonding/bond_main.c:2472
 bond_uninit+0x124/0x320 drivers/net/bonding/bond_main.c:5954
 unregister_netdevice_many_notify+0x13f8/0x2570 net/core/dev.c:12402
 ops_exit_rtnl_list net/core/net_namespace.c:187 [inline]
 ops_undo_list+0x8fc/0xab0 net/core/net_namespace.c:248
 cleanup_net+0x41b/0x830 net/core/net_namespace.c:696
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>