wifi: rtw88: usb: schedule rx work after everything is set up

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: usb: schedule rx work after everything is set up

Right now it's possible to hit NULL pointer dereference in

rtw_rx_fill_rx_status on hw object and/or its fields because

initialization routine can start getting USB replies before

rtw_dev is fully setup.

The stack trace looks like this:

rtw_rx_fill_rx_status

rtw8821c_query_rx_desc

rtw_usb_rx_handler

...

queue_work

rtw_usb_read_port_complete

...

usb_submit_urb

rtw_usb_rx_resubmit

rtw_usb_init_rx

rtw_usb_probe

So while we do the async stuff rtw_usb_probe continues and calls

rtw_register_hw, which does all kinds of initialization (e.g.

via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.

Fix this by moving the first usb_submit_urb after everything

is set up.

For me, this bug manifested as:

[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped

[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status

because I'm using Larry's backport of rtw88 driver with the NULL

checks in rtw_rx_fill_rx_status.