[BUG] ath12k: NULL deref in ath12k_mac_op_hw_scan() when a scan is requested during firmware recovery (IPQ5332 + QCN9274)

[Jeff Johnson]

On 7/31/2026 2:41 AM, Kamil Bienkiewicz wrote:
> Hi,
> 
> A scan request that arrives while the device is recovering from a firmware
> crash oopses the kernel in ath12k_mac_op_hw_scan(). Because the oops reboots
> the AP and the same firmware crash tends to recur on the next boot, this
> presents as a boot loop rather than a one-off crash.
> 
> Hardware:  GL.iNet GL-BE9300 (Flint 3) - IPQ5332 (ath12k_wifi7 AHB, 2.4 GHz)
>            + QCN9274 (ath12k_wifi7_pci, 5/6 GHz)
> Kernel:    6.18.39, OpenWrt build, ath12k as out-of-tree module (Tainted: O)

Unless you reproduce this with the upstream kernel you should be reporting
this to the OpenWrt team, not here.

If you reproduce with the upstream kernel, see:
https://wireless.docs.kernel.org/en/latest/en/users/drivers/ath12k/bugreport.html

/jeff