[PATCH v1] nl80211: Unregister nl_mgmt within nl80211_pd_stop

[Jouni Malinen]

On Mon, Sep 28, 2026 at 01:23:15PM +0000, Emily Xia wrote:
> The PD nl_mgmt is not disconnected from the eloop which causes
> an occasional use-after-free issue. If nl_mgmt is not released
> after pd_stop is called, then the process_bss_event() callback can be
> triggered against the freed struct i802_bss.
> 
> Detach drv->pd_bss first during nl80211_pd_stop() so incoming events
> do not pick it up during teardown, unsubscribe nl_mgmt, and invoke
> nl80211_destroy_bss() before freeing pd_bss. Also add the missing
> nl80211_destroy_bss() call to the nl80211_pd_start() error cleanup path.

Thanks, applied.
 
-- 
Jouni Malinen                                            PGP id EFC895FA