[PATCH v2 2/3] wifi: ath12k: prevent scan during firmware recovery

[Jose Ignacio Tornos Martinez <jtornosm@redhat.com>]

When firmware crashes while wpa_supplicant has an active connection,
wpa_supplicant may immediately attempt a scan via nl80211 while the
firmware is still powering on through MHI. ath12k_mac_op_hw_scan()
proceeds without checking the recovery state, accessing partially
initialized radio structures which leads to a NULL pointer dereference:

  BUG: unable to handle page fault for address: 0000000000001508
  RIP: ath12k_mac_op_hw_scan+0x148/0x2b0 [ath12k]
  Call Trace:
   drv_hw_scan+0x88/0x140 [mac80211]
   __ieee80211_start_scan+0x2bc/0x6b0 [mac80211]
   nl80211_trigger_scan+0x54a/0x9f0 [cfg80211]

Fix by checking ATH12K_FLAG_RECOVERY at the start of
ath12k_mac_op_hw_scan() and returning -EBUSY. mac80211 will retry the
scan after the recovery completes.

Tested on WCN7850 with MLO (Wi-Fi 7).

Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
---
v2: Fix radio[0] usage
v1: https://lore.kernel.org/all/20260727162748.963275-3-jtornosm@redhat.com/

 drivers/net/wireless/ath/ath12k/mac.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 7b7110ca6428..a57c2e91be84 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -5783,6 +5783,11 @@ int ath12k_mac_op_hw_scan(struct ieee80211_hw *hw,
 
 	lockdep_assert_wiphy(hw->wiphy);
 
+	for_each_ar(ah, ar, i) {
+		if (test_bit(ATH12K_FLAG_RECOVERY, &ar->ab->dev_flags))
+			return -EBUSY;
+	}
+
 	chan_list = kzalloc_objs(*chan_list, hw_req->req.n_channels);
 	if (!chan_list)
 		return -ENOMEM;
-- 
2.54.0