[PATCH wireless] wifi: mac80211: clear beaconing state in ieee80211_do_stop()

[Hojun Choi]

ieee80211_do_stop() zeroes vif.bss_conf.beacon_int but, unlike
ieee80211_stop_ap(), ieee80211_ibss_disconnect() and
ieee80211_stop_mesh(), leaves enable_beacon set and the
SDATA_STATE_OFFCHANNEL_BEACON_STOPPED bit pending. cfg80211 rejects a
beacon interval below 10, so a zero interval comes from this teardown,
not from userspace.

do_stop() clears SDATA_STATE_RUNNING first, so nothing acts on the stale
state while the interface is down. But do_open() re-sets RUNNING without
restoring beacon_int or clearing enable_beacon and the bit, so the state
survives a down/up cycle. A later ieee80211_offchannel_return() on scan
completion then consumes the stale bit and re-enables beaconing while
beacon_int is still 0, and drivers arming a beacon timer from the
interval divide by zero. syzbot reported this as a divide error in
mac80211_hwsim_link_info_changed(); the exact sequence that leaves
do_stop() with beaconing still enabled was not reproduced.

Clear enable_beacon and the bit in ieee80211_do_stop() as well,
mirroring the other teardown paths, so the state cannot outlive the
interface. do_stop() warns on a vif that still has valid links, so MLD
links are already torn down here and only the deflink beacon_int is
zeroed; clearing the deflink enable_beacon is sufficient.

Fixes: d6a83228823f ("mac80211: track enable_beacon explicitly")
Reported-by: syzbot+ca7a2759caaa6cd4e3db@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=ca7a2759caaa6cd4e3db
Link: https://lore.kernel.org/all/20251205153502.273426-1-dkarn@xxxxxxxxxx/
Signed-off-by: Hojun Choi <ghwns6743@xxxxxxxxx>
---
 net/mac80211/iface.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 086272c3ec08..c070d47cb631 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -719,6 +719,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
 
 	sdata->vif.bss_conf.beacon_int = 0;
 
+	/* mirror stop_ap()/IBSS/mesh: also clear the beaconing state */
+	sdata->vif.bss_conf.enable_beacon = false;
+	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
+
 	/*
 	 * If the interface goes down while suspended, presumably because
 	 * the device was unplugged and that happens before our resume,
-- 
2.54.0