[PATCH] mac802154: Cancel scan work synchronously during hardware teardown

[Aryan Arora]

Scan cleanup uses cancel_delayed_work(), which does not wait for a
running scan worker. The worker can requeue itself after cancellation,
leaving an active delayed-work timer when the PHY allocation is freed.

Cancel scan work synchronously before destroying the workqueue.

Fixes: 57588c71177f ("mac802154: Handle passive scanning")
Reported-by: syzbot+19cbce4cc656ecd4febc@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=19cbce4cc656ecd4febc
Tested-by: syzbot+19cbce4cc656ecd4febc@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Aryan Arora <aryanarora.w1@xxxxxxxxx>
---
syzbot reproduced no crash on 7.3-rc7 with the PIB teardown patch [1]
applied (base 08fa34e14e2d).
Test log: https://syzkaller.appspot.com/x/bisect.txt?x=128c8f15580000

[1] https://lore.kernel.org/all/20260627235805.17310-1-alhouseenyousef@xxxxxxxxx/#t

 net/mac802154/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/mac802154/main.c b/net/mac802154/main.c
index ea1efef3572a..5a2ab501244b 100644
--- a/net/mac802154/main.c
+++ b/net/mac802154/main.c
@@ -283,6 +283,8 @@ void ieee802154_unregister_hw(struct ieee802154_hw *hw)
 
 	rtnl_unlock();
 
+	cancel_delayed_work_sync(&local->scan_work);
+
 	destroy_workqueue(local->mac_wq);
 	destroy_workqueue(local->workqueue);
 	wpan_phy_unregister(local->phy);