When carl9170_op_start() fails partway through (e.g. after
carl9170_usb_open() but before carl9170_set_state_when() transitions
to CARL9170_STARTED), the device state remains CARL9170_IDLE.
mac80211 may still call carl9170_op_stop() in this case as part of
error cleanup.

IS_ACCEPTING_CMD() checks state >= CARL9170_IDLE, so the existing
guard in op_stop() does not prevent register writes when op_start()
never completed.  Sending USB commands to hardware that was never
fully initialized causes unnecessary command timeouts and misleading
error messages in dmesg.

Capture IS_STARTED() into a local variable before
carl9170_set_state_when() transitions CARL9170_STARTED -> IDLE.
Gate the register write block on both was_started and IS_ACCEPTING_CMD()
so that teardown register writes only occur when op_start() fully
succeeded.  carl9170_zap_queues() and carl9170_cancel_worker() are
safe to call regardless of state and remain ungated.

Signed-off-by: Masi Osmani <mas-i@hotmail.de>
---
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -442,11 +442,12 @@ static void carl9170_op_stop(struct ieee80211_hw *hw, bool suspend)
 {
 	struct ar9170 *ar = hw->priv;
+	bool was_started = IS_STARTED(ar);

 	carl9170_set_state_when(ar, CARL9170_STARTED, CARL9170_IDLE);

 	ieee80211_stop_queues(ar->hw);

 	mutex_lock(&ar->mutex);
-	if (IS_ACCEPTING_CMD(ar)) {
+	if (was_started && IS_ACCEPTING_CMD(ar)) {
 		RCU_INIT_POINTER(ar->beacon_iter, NULL);

 		carl9170_led_set_state(ar, 0);

--
Regards,
Masi Osmani