wifi: carl9170: do not ping device which has failed to load firmware

[ Upstream commit 15d25307692312cec4b57052da73387f91a2e870 ]

Syzkaller reports [1, 2] crashes caused by an attempts to ping
the device which has failed to load firmware. Since such a device
doesn't pass 'ieee80211_register_hw()', an internal workqueue
managed by 'ieee80211_queue_work()' is not yet created and an
attempt to queue work on it causes null-ptr-deref.

[1] https://syzkaller.appspot.com/bug?extid=9a4aec827829942045ff
[2] https://syzkaller.appspot.com/bug?extid=0d8afba53e8fb2633217

Fixes: e4a668c59080 ("carl9170: fix spurious restart due to high latency")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Link: https://patch.msgid.link/20250616181205.38883-1-dmantipov@yandex.ru
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index a5265997b5767cb725339eac2fd0768d04d803ef..debac4699687e1265f0b663c7f2797fb85c87ba0 100644 (file)
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -438,14 +438,21 @@ static void carl9170_usb_rx_complete(struct urb *urb)
 
                if (atomic_read(&ar->rx_anch_urbs) == 0) {
                        /*
-                        * The system is too slow to cope with
-                        * the enormous workload. We have simply
-                        * run out of active rx urbs and this
-                        * unfortunately leads to an unpredictable
-                        * device.
+                        * At this point, either the system is too slow to
+                        * cope with the enormous workload (so we have simply
+                        * run out of active rx urbs and this unfortunately
+                        * leads to an unpredictable device), or the device
+                        * is not fully functional after an unsuccessful
+                        * firmware loading attempts (so it doesn't pass
+                        * ieee80211_register_hw() and there is no internal
+                        * workqueue at all).
                         */
 
-                       ieee80211_queue_work(ar->hw, &ar->ping_work);
+                       if (ar->registered)
+                               ieee80211_queue_work(ar->hw, &ar->ping_work);
+                       else
+                               pr_warn_once("device %s is not registered\n",
+                                            dev_name(&ar->udev->dev));
                }
        } else {
                /*