wifi: ath12k: fix uaf in ath12k_core_init()

JIRA: https://issues.redhat.com/browse/RHEL-102086
CVE: CVE-2025-38116

commit f3fe49d
Author: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
Date:   Wed Jun 4 13:52:50 2025 +0800

    wifi: ath12k: fix uaf in ath12k_core_init()

    When the execution of ath12k_core_hw_group_assign() or
    ath12k_core_hw_group_create() fails, the registered notifier chain is not
    unregistered properly. Its memory is freed after rmmod, which may trigger
    to a use-after-free (UAF) issue if there is a subsequent access to this
    notifier chain.

    Fixes the issue by calling ath12k_core_panic_notifier_unregister() in
    failure cases.

    Call trace:
     notifier_chain_register+0x4c/0x1f0 (P)
     atomic_notifier_chain_register+0x38/0x68
     ath12k_core_init+0x50/0x4e8 [ath12k]
     ath12k_pci_probe+0x5f8/0xc28 [ath12k]
     pci_device_probe+0xbc/0x1a8
     really_probe+0xc8/0x3a0
     __driver_probe_device+0x84/0x1b0
     driver_probe_device+0x44/0x130
     __driver_attach+0xcc/0x208
     bus_for_each_dev+0x84/0x100
     driver_attach+0x2c/0x40
     bus_add_driver+0x130/0x260
     driver_register+0x70/0x138
     __pci_register_driver+0x68/0x80
     ath12k_pci_init+0x30/0x68 [ath12k]
     ath12k_init+0x28/0x78 [ath12k]

    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

    Fixes: 6f245ea ("wifi: ath12k: introduce device group abstraction")
    Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
    Reviewed-by: Baochen Qiang <quic_bqiang@quicinc.com>
    Link: https://patch.msgid.link/20250604055250.1228501-1-miaoqing.pan@oss.qualcomm.com
    Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

Author: CKI Backport Bot

drivers/net/wireless/ath/ath12k/core.c

@@ -1843,7 +1843,8 @@ int ath12k_core_init(struct ath12k_base *ab)
 	if (!ag) {
 		mutex_unlock(&ath12k_hw_group_mutex);
 		ath12k_warn(ab, "unable to get hw group\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err_unregister_notifier;
 	}
 
 	mutex_unlock(&ath12k_hw_group_mutex);
@@ -1858,17 +1859,20 @@ int ath12k_core_init(struct ath12k_base *ab)
 		if (ret) {
 			mutex_unlock(&ag->mutex);
 			ath12k_warn(ab, "unable to create hw group\n");
-			goto err;
+			goto err_destroy_hw_group;
 		}
 	}
 
 	mutex_unlock(&ag->mutex);
 
 	return 0;
 
-err:
+err_destroy_hw_group:
 	ath12k_core_hw_group_destroy(ab->ag);
 	ath12k_core_hw_group_unassign(ab);
+err_unregister_notifier:
+	ath12k_core_panic_notifier_unregister(ab);
+
 	return ret;
 }