Since commit 32be3ca4cf78 ("wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again") recovery zeroes the hal state instead of freeing and reallocating it, but a failed recovery still calls ath11k_hal_srng_deinit(). This frees the ring pointer buffers and the ring configuration, which only probe allocates, while the rings still point into them. Driver removal then walks the copy engine rings through the freed buffers: ath11k c000000.wifi: failed to reconfigure driver on crash recovery ... Unable to handle kernel paging request at virtual address ffffffc080ee5090 pc : ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] Call trace: ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P) ath11k_ce_cleanup_pipes+0x16c/0x4cc [ath11k] ath11k_ahb_stop+0x2c/0x3c [ath11k_ahb] ath11k_core_deinit+0xec/0x168 [ath11k] ath11k_ahb_remove+0x30/0x90 [ath11k_ahb] Return the error and keep the allocations for ath11k_ahb_remove() and ath11k_pci_remove() to free. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1 Fixes: 32be3ca4cf78 ("wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris --- drivers/net/wireless/ath/ath11k/core.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c index dd256853bab57..daa3751d75233 100644 --- a/drivers/net/wireless/ath/ath11k/core.c +++ b/drivers/net/wireless/ath/ath11k/core.c @@ -2352,15 +2352,11 @@ static int ath11k_core_reconfigure_on_crash(struct ath11k_base *ab) ret = ath11k_core_qmi_firmware_ready(ab); if (ret) - goto err_hal_srng_deinit; + return ret; clear_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags); return 0; - -err_hal_srng_deinit: - ath11k_hal_srng_deinit(ab); - return ret; } void ath11k_core_halt(struct ath11k *ar) -- 2.53.0