From: "Marek Marczykowski-Górecki" <marmarek@invisiblethingslab.com>
To: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi
Date: Wed, 15 Jul 2026 16:32:41 +0200 [thread overview]
Message-ID: <aleaCWlvrmiUcLhT@mail-itl> (raw)
[-- Attachment #1: Type: text/plain, Size: 7730 bytes --]
Hello,
I get a kernel panic when unbinding device (8086:0085) from the iwlwifi
driver (via writing to the "unbind" file in sysfs), while the wifi
connection is active. I can reproduce it on Thinkpad X230, but other
devices might be affected too. The specific crash is:
[ 286.908182] kernel BUG at mm/slub.c:634!
[ 286.908201] Oops: invalid opcode: 0000 [#1] SMP PTI
[ 286.908221] CPU: 1 UID: 0 PID: 1959 Comm: prepare-suspend Not tainted 6.18.15-1.qubes.fc41.x86_64 #1 PREEMPT(full)
[ 286.908255] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026
[ 286.908275] RIP: 0010:kfree+0x3a8/0x470
[ 286.908292] Code: 5d 41 5e 41 5f 5d e9 67 bb ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da 4c 89 ee 4c 89 e7 e8 ad 2c 00 00 e9 bd fd ff ff <0f> 0b 89 c8 4c 8d 04 03 40 f6 c6 80 0f 84 41 ff ff ff 83 e6 08 0f
[ 286.908347] RSP: 0018:ffffcfce8280bb50 EFLAGS: 00010246
[ 286.908365] RAX: ffff8b2dcef2c800 RBX: ffff8b2dcef2c800 RCX: ffff8b2dcef2c830
[ 286.908389] RDX: 00000000000be001 RSI: 0000000000000000 RDI: ffff8b2dcef2c880
[ 286.908414] RBP: ffffcfce8280bba0 R08: ffff8b2dcef2c860 R09: 0000000000000000
[ 286.908438] R10: ffff8b2dcef2c860 R11: 0000000000000000 R12: ffff8b2dd2841600
[ 286.908462] R13: fffff077003bcb00 R14: ffffffffc093c480 R15: 0000000000000060
[ 286.908487] FS: 00007b10286cd740(0000) GS:ffff8b2e19c6c000(0000) knlGS:0000000000000000
[ 286.908511] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 286.908532] CR2: 00007fb93027bc70 CR3: 00000000034f0005 CR4: 00000000001706f0
[ 286.908559] Call Trace:
[ 286.908570] <TASK>
[ 286.908581] ? _raw_spin_unlock_bh+0xe/0x20
[ 286.908599] iwl_pcie_txq_free+0x130/0x170 [iwlwifi]
[ 286.908644] iwl_pcie_tx_free+0x66/0xe0 [iwlwifi]
[ 286.908681] iwl_trans_pcie_free+0x1df/0x250 [iwlwifi]
[ 286.908719] pci_device_remove+0x42/0xb0
[ 286.908736] device_release_driver_internal+0x19c/0x200
[ 286.908755] unbind_store+0xa1/0xb0
[ 286.908771] kernfs_fop_write_iter+0x150/0x200
[ 286.908790] vfs_write+0x25d/0x450
[ 286.908806] ksys_write+0x6b/0xe0
[ 286.908825] do_syscall_64+0x84/0x800
[ 286.908842] ? syscall_exit_work+0x108/0x140
[ 286.908861] ? do_syscall_64+0xbb/0x800
[ 286.908876] ? ksys_dup3+0x63/0xf0
[ 286.908892] ? syscall_exit_work+0x108/0x140
[ 286.911388] ? do_syscall_64+0xbb/0x800
[ 286.911408] ? do_sys_openat2+0xa4/0xe0
[ 286.911423] ? syscall_exit_work+0x108/0x140
[ 286.911443] ? do_syscall_64+0xbb/0x800
[ 286.911458] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 286.911477] RIP: 0033:0x7b102873ec5e
[ 286.911493] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa
[ 286.911549] RSP: 002b:00007ffd94bc3100 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[ 286.911575] RAX: ffffffffffffffda RBX: 00007b10288ba5c0 RCX: 00007b102873ec5e
[ 286.911600] RDX: 000000000000000d RSI: 00006385db4f8020 RDI: 0000000000000001
[ 286.911625] RBP: 00007ffd94bc3110 R08: 0000000000000000 R09: 0000000000000000
[ 286.911650] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000d
[ 286.911674] R13: 000000000000000d R14: 00006385db4f8020 R15: 00006385db4f5b30
[ 286.911701] </TASK>
[ 286.911711] Modules linked in: iwldvm iwlwifi mac80211 ehci_pci ehci_hcd nft_nat nft_flow_offload nf_flow_table_inet nf_flow_table qrtr nf_conntrack_netlink nft_reject_ipv6 nf_reject_ipv6 nft_reject_ipv4 nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables joydev libarc4 intel_rapl_msr intel_rapl_common polyval_clmulni ghash_clmulni_intel cfg80211 e1000e ata_generic rfkill i2c_piix4 pata_acpi i2c_smbus pcspkr floppy vfat fat serio_raw xen_scsiback target_core_mod xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback xen_evtchn i2c_dev fuse loop nfnetlink overlay xen_blkfront [last unloaded: iwlwifi]
[ 286.911967] ---[ end trace 0000000000000000 ]---
This is running in a VM (HVM) under Xen, with relevant PCI device
attached, but I don't think it's relevant for this bug.
I've got reports about the issue in Linux 6.18.15 initially (after
updating from 6.12), but later tests identified it's a regression
somewhere between 6.15.11 and 6.16.8.
The crash still happen on 7.0.14, although it looks different there:
[ 106.379541] ------------[ cut here ]------------
[ 106.379572] kernel BUG at mm/slub.c:542!
[ 106.379596] Oops: invalid opcode: 0000 [#1] SMP PTI
[ 106.379618] CPU: 1 UID: 0 PID: 240 Comm: kworker/1:2 Not tainted 7.0.14-1.qubes.fc41.x86_64 #1 PREEMPT(full)
[ 106.379656] Hardware name: Xen HVM domU, BIOS 4.19.4 06/09/2026
[ 106.379680] Workqueue: slub_flushwq flush_cpu_sheaves
[ 106.379711] RIP: 0010:build_detached_freelist+0x1d0/0x210
[ 106.379733] Code: 41 5c 41 5d c3 cc cc cc cc 31 d2 4d 85 c0 0f 85 b2 fe ff ff 48 89 04 24 e8 7d fd ff ff 48 c7 03 00 00 00 00 48 8b 04 24 eb d0 <0f> 0b 48 85 d2 74 e3 48 89 13 4c 8b 42 08 e9 8c fe ff ff 0f 0b 31
[ 106.379795] RSP: 0000:ffffcebd804c3c88 EFLAGS: 00010246
[ 106.379815] RAX: 000000000000001d RBX: ffffcebd804c3cb8 RCX: ffff8e6240fcf000
[ 106.379843] RDX: ffff8e6240fcf000 RSI: 000000000000001d RDI: 0000000000000003
[ 106.379870] RBP: ffffffff80000000 R08: 0000000080000000 R09: ffff8e6240fcf030
[ 106.379898] R10: ffffcebd804c3d10 R11: 0000000000000000 R12: ffff8e6242a68b00
[ 106.379925] R13: ffff8e6242a68aff R14: 000000000000001c R15: 0000000000000000
[ 106.379953] FS: 0000000000000000(0000) GS:ffff8e62a837a000(0000) knlGS:0000000000000000
[ 106.379981] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 106.380004] CR2: 0000767e599f2fd0 CR3: 000000000c1d2001 CR4: 00000000001706f0
[ 106.380035] Call Trace:
[ 106.380047] <TASK>
[ 106.380060] __kmem_cache_free_bulk.part.0+0x60/0xe0
[ 106.380085] __sheaf_flush_main_batch+0xa1/0xe0
[ 106.380110] flush_cpu_sheaves+0xc3/0xe0
[ 106.380129] process_one_work+0x198/0x390
[ 106.380149] worker_thread+0x1af/0x320
[ 106.380168] ? __pfx_worker_thread+0x10/0x10
[ 106.380190] kthread+0xe3/0x120
[ 106.380207] ? __pfx_kthread+0x10/0x10
[ 106.380223] ret_from_fork+0x19e/0x260
[ 106.380241] ? __pfx_kthread+0x10/0x10
[ 106.380257] ret_from_fork_asm+0x1a/0x30
[ 106.380276] </TASK>
[ 106.380287] Modules linked in: nft_nat nft_flow_offload nf_flow_table_inet nf_flow_table nf_conntrack_netlink nft_reject_ipv6 nf_reject_ipv6 qrtr nft_reject_ipv4 nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables vfat fat intel_rapl_msr iwldvm intel_rapl_common ghash_clmulni_intel mac80211 libarc4 iwlwifi joydev cfg80211 ehci_pci pcspkr e1000e ehci_hcd rfkill floppy ata_generic i2c_piix4 pata_acpi i2c_smbus serio_raw xen_scsiback target_core_mod xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback xen_evtchn i2c_dev loop fuse nfnetlink zram lz4hc_compress lz4_compress overlay xen_blkfront
[ 106.381851] ---[ end trace 0000000000000000 ]---
This one doesn't have obvious relation to iwlwifi, but I suspect it's at
least related.
There are some more call traces at
https://github.com/QubesOS/qubes-issues/issues/10845 but they look
pretty similar.
--
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
next reply other threads:[~2026-07-15 14:32 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-15 14:32 Marek Marczykowski-Górecki [this message]
2026-07-15 17:22 ` kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi Korenblit, Miriam Rachel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aleaCWlvrmiUcLhT@mail-itl \
--to=marmarek@invisiblethingslab.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=miriam.rachel.korenblit@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.