--- a/drivers/net/wireless/ath/ath9k/hif_usb.c	2022-05-23 20:22:13.116199100 +0800
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c	2022-05-23 20:35:56.214334900 +0800
@@ -669,6 +669,8 @@ static void ath9k_hif_usb_rx_cb(struct u
 
 	if (!hif_dev)
 		goto free;
+	if (!(hif_dev->flags & HIF_USB_READY))
+		goto free;
 
 	switch (urb->status) {
 	case 0:
--- a/drivers/net/wireless/ath/ath9k/htc.h	2022-05-23 17:56:42.787981400 +0800
+++ b/drivers/net/wireless/ath/ath9k/htc.h	2022-05-23 18:30:13.191877100 +0800
@@ -629,6 +629,7 @@ static inline void ath9k_led_work(struct
 }
 #endif
 
+void ath9k_htc_free_device(struct htc_target *htc_handle);
 int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
 			   u16 devid, char *product, u32 drv_info);
 void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug);
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c	2022-05-23 17:22:52.048310400 +0800
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c	2022-05-23 18:29:08.034130600 +0800
@@ -949,12 +949,12 @@ int ath9k_htc_probe_device(struct htc_ta
 
 	ret = ath9k_htc_wait_for_target(priv);
 	if (ret)
-		goto err_free;
+		return ret;
 
 	priv->wmi = ath9k_init_wmi(priv);
 	if (!priv->wmi) {
 		ret = -EINVAL;
-		goto err_free;
+		return ret;
 	}
 
 	ret = ath9k_init_htc_services(priv, devid, drv_info);
@@ -972,11 +972,15 @@ err_init:
 	hif_dev = (struct hif_device_usb *)htc_handle->hif_dev;
 	ath9k_hif_usb_dealloc_urbs(hif_dev);
 	ath9k_destroy_wmi(priv);
-err_free:
-	ieee80211_free_hw(hw);
 	return ret;
 }
 
+void ath9k_htc_free_device(struct htc_target *htc_handle)
+{
+	if (htc_handle->drv_priv)
+		ieee80211_free_hw(htc_handle->drv_priv->hw);
+}
+
 void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug)
 {
 	if (htc_handle->drv_priv) {
@@ -987,7 +991,6 @@ void ath9k_htc_disconnect_device(struct
 
 		ath9k_deinit_device(htc_handle->drv_priv);
 		ath9k_stop_wmi(htc_handle->drv_priv);
-		ieee80211_free_hw(htc_handle->drv_priv->hw);
 	}
 }
 
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c	2022-05-23 17:50:45.509466400 +0800
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c	2022-05-23 18:25:26.908397600 +0800
@@ -498,6 +498,7 @@ struct htc_target *ath9k_htc_hw_alloc(vo
 
 void ath9k_htc_hw_free(struct htc_target *htc)
 {
+	ath9k_htc_free_device(htc);
 	kfree(htc);
 }