[PATCH 2/5] wifi: ath12k: prevent scan during firmware recovery

[Baochen Qiang]

On 7/28/2026 12:27 AM, Jose Ignacio Tornos Martinez wrote:
> When firmware crashes while wpa_supplicant has an active connection,
> wpa_supplicant may immediately attempt a scan via nl80211 while the
> firmware is still powering on through MHI. ath12k_mac_op_hw_scan()
> proceeds without checking the recovery state, accessing partially
> initialized radio structures which leads to a NULL pointer dereference:

do we know the exact structure/pointer that is causing this issue? just want to know the
details of the crash.

> 
>   BUG: unable to handle page fault for address: 0000000000001508
>   RIP: ath12k_mac_op_hw_scan+0x148/0x2b0 [ath12k]
>   Call Trace:
>    drv_hw_scan+0x88/0x140 [mac80211]
>    __ieee80211_start_scan+0x2bc/0x6b0 [mac80211]
>    nl80211_trigger_scan+0x54a/0x9f0 [cfg80211]
> 
> Fix by checking ATH12K_FLAG_RECOVERY at the start of
> ath12k_mac_op_hw_scan() and returning -EBUSY. mac80211 will retry the
> scan after the recovery completes.
> 
> Tested on WCN7850 with MLO (Wi-Fi 7).
> 
> Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm at redhat.com>
> ---
>  drivers/net/wireless/ath/ath12k/mac.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
> index f33976fc1233..924c3c21ca78 100644
> --- a/drivers/net/wireless/ath/ath12k/mac.c
> +++ b/drivers/net/wireless/ath/ath12k/mac.c
> @@ -5707,6 +5707,9 @@ int ath12k_mac_op_hw_scan(struct ieee80211_hw *hw,
>  
>  	lockdep_assert_wiphy(hw->wiphy);
>  
> +	if (test_bit(ATH12K_FLAG_RECOVERY, &ah->radio[0].ab->dev_flags))
> +		return -EBUSY;
> +
>  	chan_list = kzalloc_objs(*chan_list, hw_req->req.n_channels);
>  	if (!chan_list)
>  		return -ENOMEM;