[PATCH] wifi: ath11k: fix NULL dereference in pci remove when QMI init incomplete

[Andrei-Alexandru Bleortu]

If QMI messages never arrive (for example when qrtr_mhi is not
loaded), WLAN initialization stops before the device is registered.
In this case ATH11K_FLAG_QMI_FAIL is not set because no QMI event
handler is executed, and ATH11K_FLAG_REGISTERED is not set either.

When the driver is removed, ath11k_pci_remove() still calls
ath11k_core_deinit(), which eventually triggers
ath11k_ce_cleanup_pipes() on uninitialized CE pipes and results in a
NULL pointer dereference in ath11k_hal_srng_access_begin():

  ath11k_hal_srng_access_begin+0xc/0x60 [ath11k]
  ath11k_ce_cleanup_pipes+0x16c/0x170 [ath11k]
  ath11k_pcic_stop+0x20/0x3c [ath11k]
  ath11k_core_stop+0x30/0x58 [ath11k]
  ath11k_core_deinit+0xf8/0x1b8 [ath11k]
  ath11k_pci_remove+0x74/0x140 [ath11k_pci]

Fix this by also taking the QMI failure path in ath11k_pci_remove()
when ATH11K_FLAG_REGISTERED is not set: core initialization did not
complete, so ath11k_core_deinit() is unsafe. This is the PCI
counterpart of commit 1a7bcf5324c8 ("wifi: ath11k: fix NULL
dereference in ahb remove when QMI init incomplete").

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1

Fixes: 6fbd8898b301 ("ath11k: pci: fix rmmod crash")
Assisted-by: LLM
Signed-off-by: Andrei-Alexandru Bleortu <me@xxxxxxxxxxxx>
---
Found and fixed with an AI coding assistant (Claude Code), which also
drafted this changelog. The crash was reproduced on a Ubiquiti UniFi U6
Enterprise (IPQ5018 + 2x QCN9074) running 7.2.8 with the OpenWrt
backports ath11k: with qrtr_mhi withheld, rmmod ath11k_pci oopses as
above without this change and is clean with it. On ath-next the patch
is compile-tested (W=1) only.

 drivers/net/wireless/ath/ath11k/pci.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/pci.c b/drivers/net/wireless/ath/ath11k/pci.c
index a163168f3617..1de8ccb02487 100644
--- a/drivers/net/wireless/ath/ath11k/pci.c
+++ b/drivers/net/wireless/ath/ath11k/pci.c
@@ -1181,7 +1181,8 @@ static void ath11k_pci_remove(struct pci_dev *pdev)
 
 	ath11k_pci_set_irq_affinity_hint(ab_pci, NULL);
 
-	if (test_bit(ATH11K_FLAG_QMI_FAIL, &ab->dev_flags)) {
+	if (test_bit(ATH11K_FLAG_QMI_FAIL, &ab->dev_flags) ||
+	    !test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags)) {
 		ath11k_pci_power_down(ab, false);
 		ath11k_debugfs_soc_destroy(ab);
 		ath11k_qmi_deinit_service(ab);
-- 
2.47.3