* kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi
@ 2026-07-15 14:32 Marek Marczykowski-Górecki
2026-07-15 17:22 ` Korenblit, Miriam Rachel
0 siblings, 1 reply; 4+ messages in thread
From: Marek Marczykowski-Górecki @ 2026-07-15 14:32 UTC (permalink / raw)
To: Miri Korenblit; +Cc: linux-wireless, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 7730 bytes --]
Hello,
I get a kernel panic when unbinding device (8086:0085) from the iwlwifi
driver (via writing to the "unbind" file in sysfs), while the wifi
connection is active. I can reproduce it on Thinkpad X230, but other
devices might be affected too. The specific crash is:
[ 286.908182] kernel BUG at mm/slub.c:634!
[ 286.908201] Oops: invalid opcode: 0000 [#1] SMP PTI
[ 286.908221] CPU: 1 UID: 0 PID: 1959 Comm: prepare-suspend Not tainted 6.18.15-1.qubes.fc41.x86_64 #1 PREEMPT(full)
[ 286.908255] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026
[ 286.908275] RIP: 0010:kfree+0x3a8/0x470
[ 286.908292] Code: 5d 41 5e 41 5f 5d e9 67 bb ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da 4c 89 ee 4c 89 e7 e8 ad 2c 00 00 e9 bd fd ff ff <0f> 0b 89 c8 4c 8d 04 03 40 f6 c6 80 0f 84 41 ff ff ff 83 e6 08 0f
[ 286.908347] RSP: 0018:ffffcfce8280bb50 EFLAGS: 00010246
[ 286.908365] RAX: ffff8b2dcef2c800 RBX: ffff8b2dcef2c800 RCX: ffff8b2dcef2c830
[ 286.908389] RDX: 00000000000be001 RSI: 0000000000000000 RDI: ffff8b2dcef2c880
[ 286.908414] RBP: ffffcfce8280bba0 R08: ffff8b2dcef2c860 R09: 0000000000000000
[ 286.908438] R10: ffff8b2dcef2c860 R11: 0000000000000000 R12: ffff8b2dd2841600
[ 286.908462] R13: fffff077003bcb00 R14: ffffffffc093c480 R15: 0000000000000060
[ 286.908487] FS: 00007b10286cd740(0000) GS:ffff8b2e19c6c000(0000) knlGS:0000000000000000
[ 286.908511] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 286.908532] CR2: 00007fb93027bc70 CR3: 00000000034f0005 CR4: 00000000001706f0
[ 286.908559] Call Trace:
[ 286.908570] <TASK>
[ 286.908581] ? _raw_spin_unlock_bh+0xe/0x20
[ 286.908599] iwl_pcie_txq_free+0x130/0x170 [iwlwifi]
[ 286.908644] iwl_pcie_tx_free+0x66/0xe0 [iwlwifi]
[ 286.908681] iwl_trans_pcie_free+0x1df/0x250 [iwlwifi]
[ 286.908719] pci_device_remove+0x42/0xb0
[ 286.908736] device_release_driver_internal+0x19c/0x200
[ 286.908755] unbind_store+0xa1/0xb0
[ 286.908771] kernfs_fop_write_iter+0x150/0x200
[ 286.908790] vfs_write+0x25d/0x450
[ 286.908806] ksys_write+0x6b/0xe0
[ 286.908825] do_syscall_64+0x84/0x800
[ 286.908842] ? syscall_exit_work+0x108/0x140
[ 286.908861] ? do_syscall_64+0xbb/0x800
[ 286.908876] ? ksys_dup3+0x63/0xf0
[ 286.908892] ? syscall_exit_work+0x108/0x140
[ 286.911388] ? do_syscall_64+0xbb/0x800
[ 286.911408] ? do_sys_openat2+0xa4/0xe0
[ 286.911423] ? syscall_exit_work+0x108/0x140
[ 286.911443] ? do_syscall_64+0xbb/0x800
[ 286.911458] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 286.911477] RIP: 0033:0x7b102873ec5e
[ 286.911493] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa
[ 286.911549] RSP: 002b:00007ffd94bc3100 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[ 286.911575] RAX: ffffffffffffffda RBX: 00007b10288ba5c0 RCX: 00007b102873ec5e
[ 286.911600] RDX: 000000000000000d RSI: 00006385db4f8020 RDI: 0000000000000001
[ 286.911625] RBP: 00007ffd94bc3110 R08: 0000000000000000 R09: 0000000000000000
[ 286.911650] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000d
[ 286.911674] R13: 000000000000000d R14: 00006385db4f8020 R15: 00006385db4f5b30
[ 286.911701] </TASK>
[ 286.911711] Modules linked in: iwldvm iwlwifi mac80211 ehci_pci ehci_hcd nft_nat nft_flow_offload nf_flow_table_inet nf_flow_table qrtr nf_conntrack_netlink nft_reject_ipv6 nf_reject_ipv6 nft_reject_ipv4 nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables joydev libarc4 intel_rapl_msr intel_rapl_common polyval_clmulni ghash_clmulni_intel cfg80211 e1000e ata_generic rfkill i2c_piix4 pata_acpi i2c_smbus pcspkr floppy vfat fat serio_raw xen_scsiback target_core_mod xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback xen_evtchn i2c_dev fuse loop nfnetlink overlay xen_blkfront [last unloaded: iwlwifi]
[ 286.911967] ---[ end trace 0000000000000000 ]---
This is running in a VM (HVM) under Xen, with relevant PCI device
attached, but I don't think it's relevant for this bug.
I've got reports about the issue in Linux 6.18.15 initially (after
updating from 6.12), but later tests identified it's a regression
somewhere between 6.15.11 and 6.16.8.
The crash still happen on 7.0.14, although it looks different there:
[ 106.379541] ------------[ cut here ]------------
[ 106.379572] kernel BUG at mm/slub.c:542!
[ 106.379596] Oops: invalid opcode: 0000 [#1] SMP PTI
[ 106.379618] CPU: 1 UID: 0 PID: 240 Comm: kworker/1:2 Not tainted 7.0.14-1.qubes.fc41.x86_64 #1 PREEMPT(full)
[ 106.379656] Hardware name: Xen HVM domU, BIOS 4.19.4 06/09/2026
[ 106.379680] Workqueue: slub_flushwq flush_cpu_sheaves
[ 106.379711] RIP: 0010:build_detached_freelist+0x1d0/0x210
[ 106.379733] Code: 41 5c 41 5d c3 cc cc cc cc 31 d2 4d 85 c0 0f 85 b2 fe ff ff 48 89 04 24 e8 7d fd ff ff 48 c7 03 00 00 00 00 48 8b 04 24 eb d0 <0f> 0b 48 85 d2 74 e3 48 89 13 4c 8b 42 08 e9 8c fe ff ff 0f 0b 31
[ 106.379795] RSP: 0000:ffffcebd804c3c88 EFLAGS: 00010246
[ 106.379815] RAX: 000000000000001d RBX: ffffcebd804c3cb8 RCX: ffff8e6240fcf000
[ 106.379843] RDX: ffff8e6240fcf000 RSI: 000000000000001d RDI: 0000000000000003
[ 106.379870] RBP: ffffffff80000000 R08: 0000000080000000 R09: ffff8e6240fcf030
[ 106.379898] R10: ffffcebd804c3d10 R11: 0000000000000000 R12: ffff8e6242a68b00
[ 106.379925] R13: ffff8e6242a68aff R14: 000000000000001c R15: 0000000000000000
[ 106.379953] FS: 0000000000000000(0000) GS:ffff8e62a837a000(0000) knlGS:0000000000000000
[ 106.379981] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 106.380004] CR2: 0000767e599f2fd0 CR3: 000000000c1d2001 CR4: 00000000001706f0
[ 106.380035] Call Trace:
[ 106.380047] <TASK>
[ 106.380060] __kmem_cache_free_bulk.part.0+0x60/0xe0
[ 106.380085] __sheaf_flush_main_batch+0xa1/0xe0
[ 106.380110] flush_cpu_sheaves+0xc3/0xe0
[ 106.380129] process_one_work+0x198/0x390
[ 106.380149] worker_thread+0x1af/0x320
[ 106.380168] ? __pfx_worker_thread+0x10/0x10
[ 106.380190] kthread+0xe3/0x120
[ 106.380207] ? __pfx_kthread+0x10/0x10
[ 106.380223] ret_from_fork+0x19e/0x260
[ 106.380241] ? __pfx_kthread+0x10/0x10
[ 106.380257] ret_from_fork_asm+0x1a/0x30
[ 106.380276] </TASK>
[ 106.380287] Modules linked in: nft_nat nft_flow_offload nf_flow_table_inet nf_flow_table nf_conntrack_netlink nft_reject_ipv6 nf_reject_ipv6 qrtr nft_reject_ipv4 nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables vfat fat intel_rapl_msr iwldvm intel_rapl_common ghash_clmulni_intel mac80211 libarc4 iwlwifi joydev cfg80211 ehci_pci pcspkr e1000e ehci_hcd rfkill floppy ata_generic i2c_piix4 pata_acpi i2c_smbus serio_raw xen_scsiback target_core_mod xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback xen_evtchn i2c_dev loop fuse nfnetlink zram lz4hc_compress lz4_compress overlay xen_blkfront
[ 106.381851] ---[ end trace 0000000000000000 ]---
This one doesn't have obvious relation to iwlwifi, but I suspect it's at
least related.
There are some more call traces at
https://github.com/QubesOS/qubes-issues/issues/10845 but they look
pretty similar.
--
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread* RE: kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi 2026-07-15 14:32 kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi Marek Marczykowski-Górecki @ 2026-07-15 17:22 ` Korenblit, Miriam Rachel 2026-07-16 10:36 ` Marek Marczykowski-Górecki 0 siblings, 1 reply; 4+ messages in thread From: Korenblit, Miriam Rachel @ 2026-07-15 17:22 UTC (permalink / raw) To: Marek Marczykowski-Górecki Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org [-- Attachment #1: Type: text/plain, Size: 8523 bytes --] > -----Original Message----- > From: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> > Sent: Wednesday, July 15, 2026 5:33 PM > To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com> > Cc: linux-wireless@vger.kernel.org; linux-kernel@vger.kernel.org > Subject: kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi > > Hello, > > I get a kernel panic when unbinding device (8086:0085) from the iwlwifi driver > (via writing to the "unbind" file in sysfs), while the wifi connection is active. I can > reproduce it on Thinkpad X230, but other devices might be affected too. The > specific crash is: > > [ 286.908182] kernel BUG at mm/slub.c:634! > [ 286.908201] Oops: invalid opcode: 0000 [#1] SMP PTI > [ 286.908221] CPU: 1 UID: 0 PID: 1959 Comm: prepare-suspend Not tainted > 6.18.15-1.qubes.fc41.x86_64 #1 PREEMPT(full) > [ 286.908255] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026 > [ 286.908275] RIP: 0010:kfree+0x3a8/0x470 > [ 286.908292] Code: 5d 41 5e 41 5f 5d e9 67 bb ff ff 4d 89 f1 41 b8 01 00 00 00 > 48 89 d9 48 89 da 4c 89 ee 4c 89 e7 e8 ad 2c 00 00 e9 bd fd ff ff <0f> 0b 89 c8 4c > 8d 04 03 40 f6 c6 80 0f 84 41 ff ff ff 83 e6 08 0f > [ 286.908347] RSP: 0018:ffffcfce8280bb50 EFLAGS: 00010246 > [ 286.908365] RAX: ffff8b2dcef2c800 RBX: ffff8b2dcef2c800 RCX: > ffff8b2dcef2c830 > [ 286.908389] RDX: 00000000000be001 RSI: 0000000000000000 RDI: > ffff8b2dcef2c880 > [ 286.908414] RBP: ffffcfce8280bba0 R08: ffff8b2dcef2c860 R09: > 0000000000000000 > [ 286.908438] R10: ffff8b2dcef2c860 R11: 0000000000000000 R12: > ffff8b2dd2841600 > [ 286.908462] R13: fffff077003bcb00 R14: ffffffffc093c480 R15: > 0000000000000060 > [ 286.908487] FS: 00007b10286cd740(0000) GS:ffff8b2e19c6c000(0000) > knlGS:0000000000000000 > [ 286.908511] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 286.908532] CR2: 00007fb93027bc70 CR3: 00000000034f0005 CR4: > 00000000001706f0 > [ 286.908559] Call Trace: > [ 286.908570] <TASK> > [ 286.908581] ? _raw_spin_unlock_bh+0xe/0x20 > [ 286.908599] iwl_pcie_txq_free+0x130/0x170 [iwlwifi] > [ 286.908644] iwl_pcie_tx_free+0x66/0xe0 [iwlwifi] > [ 286.908681] iwl_trans_pcie_free+0x1df/0x250 [iwlwifi] > [ 286.908719] pci_device_remove+0x42/0xb0 > [ 286.908736] device_release_driver_internal+0x19c/0x200 > [ 286.908755] unbind_store+0xa1/0xb0 > [ 286.908771] kernfs_fop_write_iter+0x150/0x200 > [ 286.908790] vfs_write+0x25d/0x450 > [ 286.908806] ksys_write+0x6b/0xe0 > [ 286.908825] do_syscall_64+0x84/0x800 > [ 286.908842] ? syscall_exit_work+0x108/0x140 > [ 286.908861] ? do_syscall_64+0xbb/0x800 > [ 286.908876] ? ksys_dup3+0x63/0xf0 > [ 286.908892] ? syscall_exit_work+0x108/0x140 > [ 286.911388] ? do_syscall_64+0xbb/0x800 > [ 286.911408] ? do_sys_openat2+0xa4/0xe0 > [ 286.911423] ? syscall_exit_work+0x108/0x140 > [ 286.911443] ? do_syscall_64+0xbb/0x800 > [ 286.911458] entry_SYSCALL_64_after_hwframe+0x76/0x7e > [ 286.911477] RIP: 0033:0x7b102873ec5e > [ 286.911493] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 > 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 > 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa > [ 286.911549] RSP: 002b:00007ffd94bc3100 EFLAGS: 00000202 ORIG_RAX: > 0000000000000001 > [ 286.911575] RAX: ffffffffffffffda RBX: 00007b10288ba5c0 RCX: > 00007b102873ec5e > [ 286.911600] RDX: 000000000000000d RSI: 00006385db4f8020 RDI: > 0000000000000001 > [ 286.911625] RBP: 00007ffd94bc3110 R08: 0000000000000000 R09: > 0000000000000000 > [ 286.911650] R10: 0000000000000000 R11: 0000000000000202 R12: > 000000000000000d > [ 286.911674] R13: 000000000000000d R14: 00006385db4f8020 R15: > 00006385db4f5b30 > [ 286.911701] </TASK> > [ 286.911711] Modules linked in: iwldvm iwlwifi mac80211 ehci_pci ehci_hcd > nft_nat nft_flow_offload nf_flow_table_inet nf_flow_table qrtr > nf_conntrack_netlink nft_reject_ipv6 nf_reject_ipv6 nft_reject_ipv4 > nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat nf_conntrack > nf_defrag_ipv6 nf_defrag_ipv4 nf_tables joydev libarc4 intel_rapl_msr > intel_rapl_common polyval_clmulni ghash_clmulni_intel cfg80211 e1000e > ata_generic rfkill i2c_piix4 pata_acpi i2c_smbus pcspkr floppy vfat fat serio_raw > xen_scsiback target_core_mod xen_netback xen_privcmd xen_gntdev > xen_gntalloc xen_blkback xen_evtchn i2c_dev fuse loop nfnetlink overlay > xen_blkfront [last unloaded: iwlwifi] > [ 286.911967] ---[ end trace 0000000000000000 ]--- > > This is running in a VM (HVM) under Xen, with relevant PCI device attached, but I > don't think it's relevant for this bug. > > I've got reports about the issue in Linux 6.18.15 initially (after updating from > 6.12), but later tests identified it's a regression somewhere between 6.15.11 and > 6.16.8. Hi, could you please test the attached patch? It is based on 6.18 > > The crash still happen on 7.0.14, although it looks different there: > > [ 106.379541] ------------[ cut here ]------------ > [ 106.379572] kernel BUG at mm/slub.c:542! > [ 106.379596] Oops: invalid opcode: 0000 [#1] SMP PTI > [ 106.379618] CPU: 1 UID: 0 PID: 240 Comm: kworker/1:2 Not tainted 7.0.14- > 1.qubes.fc41.x86_64 #1 PREEMPT(full) > [ 106.379656] Hardware name: Xen HVM domU, BIOS 4.19.4 06/09/2026 > [ 106.379680] Workqueue: slub_flushwq flush_cpu_sheaves > [ 106.379711] RIP: 0010:build_detached_freelist+0x1d0/0x210 > [ 106.379733] Code: 41 5c 41 5d c3 cc cc cc cc 31 d2 4d 85 c0 0f 85 b2 fe ff ff > 48 89 04 24 e8 7d fd ff ff 48 c7 03 00 00 00 00 48 8b 04 24 eb d0 <0f> 0b 48 85 d2 > 74 e3 48 89 13 4c 8b 42 08 e9 8c fe ff ff 0f 0b 31 > [ 106.379795] RSP: 0000:ffffcebd804c3c88 EFLAGS: 00010246 > [ 106.379815] RAX: 000000000000001d RBX: ffffcebd804c3cb8 RCX: > ffff8e6240fcf000 > [ 106.379843] RDX: ffff8e6240fcf000 RSI: 000000000000001d RDI: > 0000000000000003 > [ 106.379870] RBP: ffffffff80000000 R08: 0000000080000000 R09: > ffff8e6240fcf030 > [ 106.379898] R10: ffffcebd804c3d10 R11: 0000000000000000 R12: > ffff8e6242a68b00 > [ 106.379925] R13: ffff8e6242a68aff R14: 000000000000001c R15: > 0000000000000000 > [ 106.379953] FS: 0000000000000000(0000) GS:ffff8e62a837a000(0000) > knlGS:0000000000000000 > [ 106.379981] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 106.380004] CR2: 0000767e599f2fd0 CR3: 000000000c1d2001 CR4: > 00000000001706f0 > [ 106.380035] Call Trace: > [ 106.380047] <TASK> > [ 106.380060] __kmem_cache_free_bulk.part.0+0x60/0xe0 > [ 106.380085] __sheaf_flush_main_batch+0xa1/0xe0 > [ 106.380110] flush_cpu_sheaves+0xc3/0xe0 > [ 106.380129] process_one_work+0x198/0x390 > [ 106.380149] worker_thread+0x1af/0x320 > [ 106.380168] ? __pfx_worker_thread+0x10/0x10 > [ 106.380190] kthread+0xe3/0x120 > [ 106.380207] ? __pfx_kthread+0x10/0x10 > [ 106.380223] ret_from_fork+0x19e/0x260 > [ 106.380241] ? __pfx_kthread+0x10/0x10 > [ 106.380257] ret_from_fork_asm+0x1a/0x30 > [ 106.380276] </TASK> > [ 106.380287] Modules linked in: nft_nat nft_flow_offload nf_flow_table_inet > nf_flow_table nf_conntrack_netlink nft_reject_ipv6 nf_reject_ipv6 qrtr > nft_reject_ipv4 nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat > nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables vfat fat intel_rapl_msr > iwldvm intel_rapl_common ghash_clmulni_intel mac80211 libarc4 iwlwifi joydev > cfg80211 ehci_pci pcspkr e1000e ehci_hcd rfkill floppy ata_generic i2c_piix4 > pata_acpi i2c_smbus serio_raw xen_scsiback target_core_mod xen_netback > xen_privcmd xen_gntdev xen_gntalloc xen_blkback xen_evtchn i2c_dev loop fuse > nfnetlink zram lz4hc_compress lz4_compress overlay xen_blkfront > [ 106.381851] ---[ end trace 0000000000000000 ]--- > > This one doesn't have obvious relation to iwlwifi, but I suspect it's at least related. > > There are some more call traces at > https://github.com/QubesOS/qubes-issues/issues/10845 but they look pretty > similar. > > -- > Best Regards, > Marek Marczykowski-Górecki > Invisible Things Lab [-- Attachment #2: 0001-wifi-iwlwifi-trans-don-t-memset-trans-conf-when-it-i.patch --] [-- Type: application/octet-stream, Size: 2148 bytes --] From 519b527a9b83fd072e74611176b08170709e4001 Mon Sep 17 00:00:00 2001 From: Miri Korenblit <miriam.rachel.korenblit@intel.com> Date: Wed, 15 Jul 2026 20:19:33 +0300 Subject: [PATCH] wifi: iwlwifi: trans: don't memset trans::conf when it is still needed Organization: Intel Israel (74) Limited Currently, trans::conf is cleared in opmode_leave(), which means that in the rest of the remove() it will be zeroed. But some of the freeing code still needs some data from it, for example the cmd_queue id. For older devices that their cmd_queue id is not 0, it can cause us to free queue 0 as it was a command queue. A command queue is different from a regular queue, the first has its cmd as regular kmalloc'ed memory while a regular queue has it from a kmem_cache, so the two should be freed differently. To avoid that, clear the trans::conf before we call the opmode instead. Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> --- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 ++ drivers/net/wireless/intel/iwlwifi/iwl-trans.c | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c index 607fcea6f4ef..41fc45daa726 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c @@ -1549,6 +1549,8 @@ _iwl_op_mode_start(struct iwl_drv *drv, struct iwlwifi_opmode_table *op) dbgfs_dir = drv->dbgfs_op_mode; #endif + memset(&drv->trans->conf, 0, sizeof(drv->trans->conf)); + op_mode = ops->start(drv->trans, drv->trans->cfg, &drv->fw, dbgfs_dir); diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c index 5232f66c2d52..b25d54cfcfb7 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c @@ -423,7 +423,6 @@ void iwl_trans_op_mode_leave(struct iwl_trans *trans) cancel_delayed_work_sync(&trans->restart.wk); trans->op_mode = NULL; - memset(&trans->conf, 0, sizeof(trans->conf)); trans->state = IWL_TRANS_NO_FW; } -- 2.34.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi 2026-07-15 17:22 ` Korenblit, Miriam Rachel @ 2026-07-16 10:36 ` Marek Marczykowski-Górecki 2026-07-16 10:56 ` Korenblit, Miriam Rachel 0 siblings, 1 reply; 4+ messages in thread From: Marek Marczykowski-Górecki @ 2026-07-16 10:36 UTC (permalink / raw) To: Korenblit, Miriam Rachel Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org [-- Attachment #1: Type: text/plain, Size: 5648 bytes --] On Wed, Jul 15, 2026 at 05:22:44PM +0000, Korenblit, Miriam Rachel wrote: > > > > -----Original Message----- > > From: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> > > Sent: Wednesday, July 15, 2026 5:33 PM > > To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com> > > Cc: linux-wireless@vger.kernel.org; linux-kernel@vger.kernel.org > > Subject: kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi > > > > Hello, > > > > I get a kernel panic when unbinding device (8086:0085) from the iwlwifi driver > > (via writing to the "unbind" file in sysfs), while the wifi connection is active. I can > > reproduce it on Thinkpad X230, but other devices might be affected too. The > > specific crash is: > > > > [ 286.908182] kernel BUG at mm/slub.c:634! > > [ 286.908201] Oops: invalid opcode: 0000 [#1] SMP PTI > > [ 286.908221] CPU: 1 UID: 0 PID: 1959 Comm: prepare-suspend Not tainted > > 6.18.15-1.qubes.fc41.x86_64 #1 PREEMPT(full) > > [ 286.908255] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026 > > [ 286.908275] RIP: 0010:kfree+0x3a8/0x470 > > [ 286.908292] Code: 5d 41 5e 41 5f 5d e9 67 bb ff ff 4d 89 f1 41 b8 01 00 00 00 > > 48 89 d9 48 89 da 4c 89 ee 4c 89 e7 e8 ad 2c 00 00 e9 bd fd ff ff <0f> 0b 89 c8 4c > > 8d 04 03 40 f6 c6 80 0f 84 41 ff ff ff 83 e6 08 0f > > [ 286.908347] RSP: 0018:ffffcfce8280bb50 EFLAGS: 00010246 > > [ 286.908365] RAX: ffff8b2dcef2c800 RBX: ffff8b2dcef2c800 RCX: > > ffff8b2dcef2c830 > > [ 286.908389] RDX: 00000000000be001 RSI: 0000000000000000 RDI: > > ffff8b2dcef2c880 > > [ 286.908414] RBP: ffffcfce8280bba0 R08: ffff8b2dcef2c860 R09: > > 0000000000000000 > > [ 286.908438] R10: ffff8b2dcef2c860 R11: 0000000000000000 R12: > > ffff8b2dd2841600 > > [ 286.908462] R13: fffff077003bcb00 R14: ffffffffc093c480 R15: > > 0000000000000060 > > [ 286.908487] FS: 00007b10286cd740(0000) GS:ffff8b2e19c6c000(0000) > > knlGS:0000000000000000 > > [ 286.908511] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > [ 286.908532] CR2: 00007fb93027bc70 CR3: 00000000034f0005 CR4: > > 00000000001706f0 > > [ 286.908559] Call Trace: > > [ 286.908570] <TASK> > > [ 286.908581] ? _raw_spin_unlock_bh+0xe/0x20 > > [ 286.908599] iwl_pcie_txq_free+0x130/0x170 [iwlwifi] > > [ 286.908644] iwl_pcie_tx_free+0x66/0xe0 [iwlwifi] > > [ 286.908681] iwl_trans_pcie_free+0x1df/0x250 [iwlwifi] > > [ 286.908719] pci_device_remove+0x42/0xb0 > > [ 286.908736] device_release_driver_internal+0x19c/0x200 > > [ 286.908755] unbind_store+0xa1/0xb0 > > [ 286.908771] kernfs_fop_write_iter+0x150/0x200 > > [ 286.908790] vfs_write+0x25d/0x450 > > [ 286.908806] ksys_write+0x6b/0xe0 > > [ 286.908825] do_syscall_64+0x84/0x800 > > [ 286.908842] ? syscall_exit_work+0x108/0x140 > > [ 286.908861] ? do_syscall_64+0xbb/0x800 > > [ 286.908876] ? ksys_dup3+0x63/0xf0 > > [ 286.908892] ? syscall_exit_work+0x108/0x140 > > [ 286.911388] ? do_syscall_64+0xbb/0x800 > > [ 286.911408] ? do_sys_openat2+0xa4/0xe0 > > [ 286.911423] ? syscall_exit_work+0x108/0x140 > > [ 286.911443] ? do_syscall_64+0xbb/0x800 > > [ 286.911458] entry_SYSCALL_64_after_hwframe+0x76/0x7e > > [ 286.911477] RIP: 0033:0x7b102873ec5e > > [ 286.911493] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 > > 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 > > 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa > > [ 286.911549] RSP: 002b:00007ffd94bc3100 EFLAGS: 00000202 ORIG_RAX: > > 0000000000000001 > > [ 286.911575] RAX: ffffffffffffffda RBX: 00007b10288ba5c0 RCX: > > 00007b102873ec5e > > [ 286.911600] RDX: 000000000000000d RSI: 00006385db4f8020 RDI: > > 0000000000000001 > > [ 286.911625] RBP: 00007ffd94bc3110 R08: 0000000000000000 R09: > > 0000000000000000 > > [ 286.911650] R10: 0000000000000000 R11: 0000000000000202 R12: > > 000000000000000d > > [ 286.911674] R13: 000000000000000d R14: 00006385db4f8020 R15: > > 00006385db4f5b30 > > [ 286.911701] </TASK> > > [ 286.911711] Modules linked in: iwldvm iwlwifi mac80211 ehci_pci ehci_hcd > > nft_nat nft_flow_offload nf_flow_table_inet nf_flow_table qrtr > > nf_conntrack_netlink nft_reject_ipv6 nf_reject_ipv6 nft_reject_ipv4 > > nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat nf_conntrack > > nf_defrag_ipv6 nf_defrag_ipv4 nf_tables joydev libarc4 intel_rapl_msr > > intel_rapl_common polyval_clmulni ghash_clmulni_intel cfg80211 e1000e > > ata_generic rfkill i2c_piix4 pata_acpi i2c_smbus pcspkr floppy vfat fat serio_raw > > xen_scsiback target_core_mod xen_netback xen_privcmd xen_gntdev > > xen_gntalloc xen_blkback xen_evtchn i2c_dev fuse loop nfnetlink overlay > > xen_blkfront [last unloaded: iwlwifi] > > [ 286.911967] ---[ end trace 0000000000000000 ]--- > > > > This is running in a VM (HVM) under Xen, with relevant PCI device attached, but I > > don't think it's relevant for this bug. > > > > I've got reports about the issue in Linux 6.18.15 initially (after updating from > > 6.12), but later tests identified it's a regression somewhere between 6.15.11 and > > 6.16.8. > > Hi, could you please test the attached patch? > It is based on 6.18 Yes, the patch fixes it! Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> -- Best Regards, Marek Marczykowski-Górecki Invisible Things Lab [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 488 bytes --] ^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi 2026-07-16 10:36 ` Marek Marczykowski-Górecki @ 2026-07-16 10:56 ` Korenblit, Miriam Rachel 0 siblings, 0 replies; 4+ messages in thread From: Korenblit, Miriam Rachel @ 2026-07-16 10:56 UTC (permalink / raw) To: Marek Marczykowski-Górecki Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org > -----Original Message----- > From: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> > Sent: Thursday, July 16, 2026 1:36 PM > To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com> > Cc: linux-wireless@vger.kernel.org; linux-kernel@vger.kernel.org > Subject: Re: kernel BUG at mm/slub.c:634 (kfree) when unbinding device from > iwlwifi > > On Wed, Jul 15, 2026 at 05:22:44PM +0000, Korenblit, Miriam Rachel wrote: > > > > > > > -----Original Message----- > > > From: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> > > > Sent: Wednesday, July 15, 2026 5:33 PM > > > To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com> > > > Cc: linux-wireless@vger.kernel.org; linux-kernel@vger.kernel.org > > > Subject: kernel BUG at mm/slub.c:634 (kfree) when unbinding device > > > from iwlwifi > > > > > > Hello, > > > > > > I get a kernel panic when unbinding device (8086:0085) from the > > > iwlwifi driver (via writing to the "unbind" file in sysfs), while > > > the wifi connection is active. I can reproduce it on Thinkpad X230, > > > but other devices might be affected too. The specific crash is: > > > > > > [ 286.908182] kernel BUG at mm/slub.c:634! > > > [ 286.908201] Oops: invalid opcode: 0000 [#1] SMP PTI > > > [ 286.908221] CPU: 1 UID: 0 PID: 1959 Comm: prepare-suspend Not > > > tainted > > > 6.18.15-1.qubes.fc41.x86_64 #1 PREEMPT(full) > > > [ 286.908255] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026 > > > [ 286.908275] RIP: 0010:kfree+0x3a8/0x470 > > > [ 286.908292] Code: 5d 41 5e 41 5f 5d e9 67 bb ff ff 4d 89 f1 > > > 41 b8 01 00 00 00 > > > 48 89 d9 48 89 da 4c 89 ee 4c 89 e7 e8 ad 2c 00 00 e9 bd fd ff ff > > > <0f> 0b 89 c8 4c 8d 04 03 40 f6 c6 80 0f 84 41 ff ff ff 83 e6 08 0f > > > [ 286.908347] RSP: 0018:ffffcfce8280bb50 EFLAGS: 00010246 > > > [ 286.908365] RAX: ffff8b2dcef2c800 RBX: ffff8b2dcef2c800 RCX: > > > ffff8b2dcef2c830 > > > [ 286.908389] RDX: 00000000000be001 RSI: 0000000000000000 RDI: > > > ffff8b2dcef2c880 > > > [ 286.908414] RBP: ffffcfce8280bba0 R08: ffff8b2dcef2c860 R09: > > > 0000000000000000 > > > [ 286.908438] R10: ffff8b2dcef2c860 R11: 0000000000000000 R12: > > > ffff8b2dd2841600 > > > [ 286.908462] R13: fffff077003bcb00 R14: ffffffffc093c480 R15: > > > 0000000000000060 > > > [ 286.908487] FS: 00007b10286cd740(0000) > > > GS:ffff8b2e19c6c000(0000) > > > knlGS:0000000000000000 > > > [ 286.908511] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > > [ 286.908532] CR2: 00007fb93027bc70 CR3: 00000000034f0005 CR4: > > > 00000000001706f0 > > > [ 286.908559] Call Trace: > > > [ 286.908570] <TASK> > > > [ 286.908581] ? _raw_spin_unlock_bh+0xe/0x20 > > > [ 286.908599] iwl_pcie_txq_free+0x130/0x170 [iwlwifi] > > > [ 286.908644] iwl_pcie_tx_free+0x66/0xe0 [iwlwifi] > > > [ 286.908681] iwl_trans_pcie_free+0x1df/0x250 [iwlwifi] > > > [ 286.908719] pci_device_remove+0x42/0xb0 > > > [ 286.908736] device_release_driver_internal+0x19c/0x200 > > > [ 286.908755] unbind_store+0xa1/0xb0 > > > [ 286.908771] kernfs_fop_write_iter+0x150/0x200 > > > [ 286.908790] vfs_write+0x25d/0x450 > > > [ 286.908806] ksys_write+0x6b/0xe0 > > > [ 286.908825] do_syscall_64+0x84/0x800 > > > [ 286.908842] ? syscall_exit_work+0x108/0x140 > > > [ 286.908861] ? do_syscall_64+0xbb/0x800 > > > [ 286.908876] ? ksys_dup3+0x63/0xf0 > > > [ 286.908892] ? syscall_exit_work+0x108/0x140 > > > [ 286.911388] ? do_syscall_64+0xbb/0x800 > > > [ 286.911408] ? do_sys_openat2+0xa4/0xe0 > > > [ 286.911423] ? syscall_exit_work+0x108/0x140 > > > [ 286.911443] ? do_syscall_64+0xbb/0x800 > > > [ 286.911458] entry_SYSCALL_64_after_hwframe+0x76/0x7e > > > [ 286.911477] RIP: 0033:0x7b102873ec5e > > > [ 286.911493] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b > > > 93 08 03 00 00 > > > 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 > > > <c9> c3 83 e2 > > > 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa > > > [ 286.911549] RSP: 002b:00007ffd94bc3100 EFLAGS: 00000202 ORIG_RAX: > > > 0000000000000001 > > > [ 286.911575] RAX: ffffffffffffffda RBX: 00007b10288ba5c0 RCX: > > > 00007b102873ec5e > > > [ 286.911600] RDX: 000000000000000d RSI: 00006385db4f8020 RDI: > > > 0000000000000001 > > > [ 286.911625] RBP: 00007ffd94bc3110 R08: 0000000000000000 R09: > > > 0000000000000000 > > > [ 286.911650] R10: 0000000000000000 R11: 0000000000000202 R12: > > > 000000000000000d > > > [ 286.911674] R13: 000000000000000d R14: 00006385db4f8020 R15: > > > 00006385db4f5b30 > > > [ 286.911701] </TASK> > > > [ 286.911711] Modules linked in: iwldvm iwlwifi mac80211 > > > ehci_pci ehci_hcd nft_nat nft_flow_offload nf_flow_table_inet > > > nf_flow_table qrtr nf_conntrack_netlink nft_reject_ipv6 > > > nf_reject_ipv6 nft_reject_ipv4 > > > nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat > > > nf_conntrack > > > nf_defrag_ipv6 nf_defrag_ipv4 nf_tables joydev libarc4 > > > intel_rapl_msr intel_rapl_common polyval_clmulni ghash_clmulni_intel > > > cfg80211 e1000e ata_generic rfkill i2c_piix4 pata_acpi i2c_smbus > > > pcspkr floppy vfat fat serio_raw xen_scsiback target_core_mod > > > xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback > > > xen_evtchn i2c_dev fuse loop nfnetlink overlay xen_blkfront [last unloaded: > iwlwifi] > > > [ 286.911967] ---[ end trace 0000000000000000 ]--- > > > > > > This is running in a VM (HVM) under Xen, with relevant PCI device > > > attached, but I don't think it's relevant for this bug. > > > > > > I've got reports about the issue in Linux 6.18.15 initially (after > > > updating from 6.12), but later tests identified it's a regression > > > somewhere between 6.15.11 and 6.16.8. > > > > Hi, could you please test the attached patch? > > It is based on 6.18 > > Yes, the patch fixes it! Thank you for testing! I'll send a fix. > > Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> > > -- > Best Regards, > Marek Marczykowski-Górecki > Invisible Things Lab ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-16 10:56 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-07-15 14:32 kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi Marek Marczykowski-Górecki 2026-07-15 17:22 ` Korenblit, Miriam Rachel 2026-07-16 10:36 ` Marek Marczykowski-Górecki 2026-07-16 10:56 ` Korenblit, Miriam Rachel
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.