While a MEI limited scan is in progress, iwl_mvm_mei_filter_scan()
queues beacon and probe-response frames and schedules
iwl_mvm_mei_scan_work() to re-inject matching frames into mac80211.

Nothing cancels this work.  When the driver is unloaded,
iwl_op_mode_mvm_stop() eventually frees mvm as part of
ieee80211_free_hw().  A queued or running work item could then
dereference the freed mvm: its handler obtains mvm with
container_of(), takes mvm->mutex, and accesses csme_conn_info, which
the stop path frees before ieee80211_free_hw().

Cancel and drain the work in iwl_mvm_mac_stop(), after RX has been
stopped and after releasing mvm->mutex, which the work handler takes.
Also purge queued scan results.

This issue was found by an in-house static analysis tool.

Fixes: 0d2558838ee8 ("wifi: iwlwifi: modify scan request and results when in link protection")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 74bd4038f..8b123f6df 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -1423,6 +1423,10 @@ void iwl_mvm_mac_stop(struct ieee80211_hw *hw, bool suspend)
 	 */
 	cancel_work_sync(&mvm->async_handlers_wk);
 	wiphy_work_cancel(hw->wiphy, &mvm->async_handlers_wiphy_wk);
+
+	/* The work takes mvm->mutex, so cancel it after releasing the mutex. */
+	cancel_work_sync(&mvm->mei_scan_filter.scan_work);
+	skb_queue_purge(&mvm->mei_scan_filter.scan_res);
 }

 struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)