Re: Use-after-free in iwl-mld after hardware fails to restart.

[Ben Greear <greearb@candelatech.com>]

On 3/3/26 06:27, Ben Greear wrote:
> On 3/2/26 23:19, Korenblit, Miriam Rachel wrote:
>>
>>
>>> -----Original Message-----
>>> From: Ben Greear <greearb@candelatech.com>
>>> Sent: Monday, March 2, 2026 9:00 PM
>>> To: linux-wireless <linux-wireless@vger.kernel.org>; Korenblit, Miriam Rachel
>>> <miriam.rachel.korenblit@intel.com>
>>> Subject: Use-after-free in iwl-mld after hardware fails to restart.
>>>
>>> Hello,
>>>
>>> Here's another failure case from my torture test system.
>>>
>>> This is from a patched 6.18.14+ kernel, but from a look at upstream Linux
>>> kernel, the problems are there as well.
>>>
>>> I believe the problem is something like this:
>>>
>>> firmware crashes several times and cannot recover.  Maybe
>>> Intel folks can tell why it is crashing?  I'd love to know if that
>>> is something that can be fixed in the driver.
>>>
>>>   From mac80211/util.c:
>>>
>>> int ieee80211_reconfig(struct ieee80211_local *local)
>>> is called, and gets to the failure case in this code (I see that second WARN in the
>>> crash logs)
>>> .....
>>>     /*
>>>      * Upon resume hardware can sometimes be goofy due to
>>>      * various platform / driver / bus issues, so restarting
>>>      * the device may at times not work immediately. Propagate
>>>      * the error.
>>>      */
>>>     res = drv_start(local);
>>>     if (res) {
>>>         if (suspended)
>>>             WARN(1, "Hardware became unavailable upon resume.
>>> This could be a software issue prior to suspend or a hardware issue.\n");
>>>         else
>>>             WARN(1, "Hardware became unavailable during
>>> restart.\n");
>>>         ieee80211_wake_queues_by_reason(hw,
>>> IEEE80211_MAX_QUEUE_MAP,
>>>
>>>     IEEE80211_QUEUE_STOP_REASON_SUSPEND,
>>>                         false);
>>>         ieee80211_handle_reconfig_failure(local);
>>>         return res;
>>>
>>>
>>> This method has comments about cleaning things up, but I don't see where it
>>> actually
>>> cleans up the driver.  And it sets SDATA_IN_DRIVER to false, so a lot of the calls
>>> in driver-ops.h that would otherwise tell the driver to clean up skip calls to
>>> the driver.
>>>
>>> static void ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
>>> {
>>>     struct ieee80211_sub_if_data *sdata;
>>>     struct ieee80211_chanctx *ctx;
>>>
>>>     lockdep_assert_wiphy(local->hw.wiphy);
>>>
>>>     /*
>>>      * We get here if during resume the device can't be restarted properly.
>>>      * We might also get here if this happens during HW reset, which is a
>>>      * slightly different situation and we need to drop all connections in
>>>      * the latter case.
>>>      *
>>>      * Ask cfg80211 to turn off all interfaces, this will result in more
>>>      * warnings but at least we'll then get into a clean stopped state.
>>>      */
>>>
>>>     local->resuming = false;
>>>     local->suspended = false;
>>>     local->in_reconfig = false;
>>>     local->reconfig_failure = true;
>>>
>>>     ieee80211_flush_completed_scan(local, true);
>>>
>>>     /* scheduled scan clearly can't be running any more, but tell
>>>      * cfg80211 and clear local state
>>>      */
>>>     ieee80211_sched_scan_end(local);
>>>
>>>     list_for_each_entry(sdata, &local->interfaces, list)
>>>         sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;
>>>
>>>     /* Mark channel contexts as not being in the driver any more to avoid
>>>      * removing them from the driver during the shutdown process...
>>>      */
>>>     list_for_each_entry(ctx, &local->chanctx_list, list)
>>>         ctx->driver_present = false;
>>> }
>>>
>>>
>>> So, how is the driver supposed to be cleaned up in this scenario?
>> Driver was cleaned up in drv_start. See iwl_mld_restart_cleanup.
>> Could you please share the iwlmld.ko and iwlwifi.ko files?
> 
> I have already made code changes and re-compiled to try to track it down.
> 
> If you can let me know what sort of information you'd like to see (like
> gdb code listings?) I can gather it next time I can reproduce the problem.
> 
> Any idea why the firmware is crashing?
> 
> Thanks,
> Ben
> 

I hit something like this again just now, here is the logs from the kdump vmcore-dmesg
file.   wlan11 is on the bus 0000:36:00.0 radio.  My previously posted work-arounds help in
other cases, but seems it does not fully solve use-after-free down in iwlmld.  I'll work on
on a way to fix this, but suggestions are welcome.


[start of file, but obviously more logs above this]

[ 3494.878836] iwlwifi 0000:36:00.0: Transport status: 0x0000014A, valid: 7
[ 3494.884282] iwlwifi 0000:36:00.0: 0x20000070 | NMI_INTERRUPT_LMAC_FATAL
[ 3494.889638] iwlwifi 0000:36:00.0: 0x00000000 | umac branchlink1
[ 3494.894369] iwlwifi 0000:36:00.0: 0xC00808AA | umac branchlink2
[ 3494.899033] iwlwifi 0000:36:00.0: 0x80287BFE | umac interruptlink1
[ 3494.903939] iwlwifi 0000:36:00.0: 0xC008462C | umac interruptlink2
[ 3494.908882] iwlwifi 0000:36:00.0: 0x00000002 | umac data1
[ 3494.913001] iwlwifi 0000:36:00.0: 0xC008462C | umac data2
[ 3494.917134] iwlwifi 0000:36:00.0: 0x00000000 | umac data3
[ 3494.921275] iwlwifi 0000:36:00.0: 0x00000065 | umac major
[ 3494.925428] iwlwifi 0000:36:00.0: 0x6EF20B19 | umac minor
[ 3494.929553] iwlwifi 0000:36:00.0: 0x0007295B | frame pointer
[ 3494.933953] iwlwifi 0000:36:00.0: 0xD00D6258 | stack pointer
[ 3494.938360] iwlwifi 0000:36:00.0: 0x0001016A | last host cmd
[ 3494.942921] iwlwifi 0000:36:00.0: 0x00000000 | isr status reg
[ 3494.947502] iwlwifi 0000:36:00.0: TCM1 status:
[ 3494.950682] iwlwifi 0000:36:00.0: 0x00000070 | error ID
[ 3494.954654] iwlwifi 0000:36:00.0: 0x00001D2E | tcm branchlink2
[ 3494.959297] iwlwifi 0000:36:00.0: 0x0000211C | tcm interruptlink1
[ 3494.964135] iwlwifi 0000:36:00.0: 0x0000211C | tcm interruptlink2
[ 3494.968954] iwlwifi 0000:36:00.0: 0x40000000 | tcm data1
[ 3494.973032] iwlwifi 0000:36:00.0: 0xDEADBEEF | tcm data2
[ 3494.977066] iwlwifi 0000:36:00.0: 0xDEADBEEF | tcm data3
[ 3494.981105] iwlwifi 0000:36:00.0: 0x00001DAC | tcm log PC
[ 3494.985235] iwlwifi 0000:36:00.0: 0x00803FF0 | tcm frame pointer
[ 3494.990031] iwlwifi 0000:36:00.0: 0x00803F5C | tcm stack pointer
[ 3494.994792] iwlwifi 0000:36:00.0: 0x00000000 | tcm msg ID
[ 3494.998921] iwlwifi 0000:36:00.0: 0x40080000 | tcm ISR status
[ 3495.003417] iwlwifi 0000:36:00.0: 0x000002F0 | tcm HW status[0]
[ 3495.008143] iwlwifi 0000:36:00.0: 0x00000000 | tcm HW status[1]
[ 3495.012785] iwlwifi 0000:36:00.0: 0x00000000 | tcm HW status[2]
[ 3495.017447] iwlwifi 0000:36:00.0: 0x00008100 | tcm HW status[3]
[ 3495.022154] iwlwifi 0000:36:00.0: 0x00000000 | tcm HW status[4]
[ 3495.026812] iwlwifi 0000:36:00.0: 0x00000000 | tcm SW status[0]
[ 3495.031608] iwlwifi 0000:36:00.0: RCM1 status:
[ 3495.034792] iwlwifi 0000:36:00.0: 0x00000070 | error ID
[ 3495.038840] iwlwifi 0000:36:00.0: 0x00001E2E | rcm branchlink2
[ 3495.043414] iwlwifi 0000:36:00.0: 0x000027A0 | rcm interruptlink1
[ 3495.048248] iwlwifi 0000:36:00.0: 0x000027A0 | rcm interruptlink2
[ 3495.053182] iwlwifi 0000:36:00.0: 0x20000000 | rcm data1
[ 3495.057450] iwlwifi 0000:36:00.0: 0xDEADBEEF | rcm data2
[ 3495.061499] iwlwifi 0000:36:00.0: 0xDEADBEEF | rcm data3
[ 3495.065536] iwlwifi 0000:36:00.0: 0x00001E98 | rcm log PC
[ 3495.069770] iwlwifi 0000:36:00.0: 0x00803FF0 | rcm frame pointer
[ 3495.074511] iwlwifi 0000:36:00.0: 0x00803F5C | rcm stack pointer
[ 3495.079238] iwlwifi 0000:36:00.0: 0x00000000 | rcm msg ID
[ 3495.083362] iwlwifi 0000:36:00.0: 0x20000000 | rcm ISR status
[ 3495.087864] iwlwifi 0000:36:00.0: 0x00420500 | frame HW status
[ 3495.092420] iwlwifi 0000:36:00.0: 0x00000000 | LMAC-to-RCM request mbox
[ 3495.097785] iwlwifi 0000:36:00.0: 0x00000000 | RCM-to-LMAC request mbox
[ 3495.103207] iwlwifi 0000:36:00.0: 0x00000000 | MAC header control
[ 3495.108022] iwlwifi 0000:36:00.0: 0x00000000 | MAC header addr1 low
[ 3495.113015] iwlwifi 0000:36:00.0: 0x003C0000 | MAC header info
[ 3495.117652] iwlwifi 0000:36:00.0: 0x00000000 | MAC header error
[ 3495.122379] iwlwifi 0000:36:00.0: TCM2 status:
[ 3495.125549] iwlwifi 0000:36:00.0: 0x00000070 | error ID
[ 3495.129511] iwlwifi 0000:36:00.0: 0x00001D2E | tcm branchlink2
[ 3495.134131] iwlwifi 0000:36:00.0: 0x0000211C | tcm interruptlink1
[ 3495.138958] iwlwifi 0000:36:00.0: 0x0000211C | tcm interruptlink2
[ 3495.143789] iwlwifi 0000:36:00.0: 0x40000000 | tcm data1
[ 3495.148002] iwlwifi 0000:36:00.0: 0xDEADBEEF | tcm data2
[ 3495.152057] iwlwifi 0000:36:00.0: 0xDEADBEEF | tcm data3
[ 3495.156113] iwlwifi 0000:36:00.0: 0x00001DAC | tcm log PC
[ 3495.160241] iwlwifi 0000:36:00.0: 0x00803FF0 | tcm frame pointer
[ 3495.165010] iwlwifi 0000:36:00.0: 0x00803F5C | tcm stack pointer
[ 3495.169754] iwlwifi 0000:36:00.0: 0x00000000 | tcm msg ID
[ 3495.173894] iwlwifi 0000:36:00.0: 0x40080000 | tcm ISR status
[ 3495.178380] iwlwifi 0000:36:00.0: 0x000002F0 | tcm HW status[0]
[ 3495.183093] iwlwifi 0000:36:00.0: 0x00000000 | tcm HW status[1]
[ 3495.187778] iwlwifi 0000:36:00.0: 0x00000000 | tcm HW status[2]
[ 3495.192457] iwlwifi 0000:36:00.0: 0x00008000 | tcm HW status[3]
[ 3495.197171] iwlwifi 0000:36:00.0: 0x00000000 | tcm HW status[4]
[ 3495.201818] iwlwifi 0000:36:00.0: 0x00000000 | tcm SW status[0]
[ 3495.206557] iwlwifi 0000:36:00.0: RCM2 status:
[ 3495.209741] iwlwifi 0000:36:00.0: 0x00000070 | error ID
[ 3495.213759] iwlwifi 0000:36:00.0: 0x00001E2E | rcm branchlink2
[ 3495.218334] iwlwifi 0000:36:00.0: 0x000027A0 | rcm interruptlink1
[ 3495.223171] iwlwifi 0000:36:00.0: 0x000027A0 | rcm interruptlink2
[ 3495.228036] iwlwifi 0000:36:00.0: 0x20000000 | rcm data1
[ 3495.232073] iwlwifi 0000:36:00.0: 0xDEADBEEF | rcm data2
[ 3495.236110] iwlwifi 0000:36:00.0: 0xDEADBEEF | rcm data3
[ 3495.240163] iwlwifi 0000:36:00.0: 0x00001E98 | rcm log PC
[ 3495.244352] iwlwifi 0000:36:00.0: 0x00803FF0 | rcm frame pointer
[ 3495.249099] iwlwifi 0000:36:00.0: 0x00803F5C | rcm stack pointer
[ 3495.253841] iwlwifi 0000:36:00.0: 0x00000000 | rcm msg ID
[ 3495.257984] iwlwifi 0000:36:00.0: 0x20000000 | rcm ISR status
[ 3495.262512] iwlwifi 0000:36:00.0: 0x00420500 | frame HW status
[ 3495.267085] iwlwifi 0000:36:00.0: 0x00000000 | LMAC-to-RCM request mbox
[ 3495.272467] iwlwifi 0000:36:00.0: 0x00000000 | RCM-to-LMAC request mbox
[ 3495.277912] iwlwifi 0000:36:00.0: 0x00000000 | MAC header control
[ 3495.282758] iwlwifi 0000:36:00.0: 0x00000000 | MAC header addr1 low
[ 3495.287772] iwlwifi 0000:36:00.0: 0x003C0000 | MAC header info
[ 3495.292384] iwlwifi 0000:36:00.0: 0x00000000 | MAC header error
[ 3495.297079] iwlwifi 0000:36:00.0: IML/ROM dump:
[ 3495.300348] iwlwifi 0000:36:00.0: 0x00000B03 | IML/ROM error/state
[ 3495.305291] iwlwifi 0000:36:00.0: 0x0000EF94 | IML/ROM data1
[ 3495.309772] iwlwifi 0000:36:00.0: 0x00000080 | IML/ROM WFPM_AUTH_KEY_0
[ 3495.315054] iwlwifi 0000:36:00.0: Fseq Registers:
[ 3495.318508] iwlwifi 0000:36:00.0: 0x67A00000 | FSEQ_ERROR_CODE
[ 3495.323084] iwlwifi 0000:36:00.0: 0x80B10006 | FSEQ_TOP_INIT_VERSION
[ 3495.328205] iwlwifi 0000:36:00.0: 0x00570000 | FSEQ_CNVIO_INIT_VERSION
[ 3495.333479] iwlwifi 0000:36:00.0: 0x0000AA14 | FSEQ_OTP_VERSION
[ 3495.338133] iwlwifi 0000:36:00.0: 0x0000000F | FSEQ_TOP_CONTENT_VERSION
[ 3495.343515] iwlwifi 0000:36:00.0: 0x4552414E | FSEQ_ALIVE_TOKEN
[ 3495.348165] iwlwifi 0000:36:00.0: 0x02001910 | FSEQ_CNVI_ID
[ 3495.352470] iwlwifi 0000:36:00.0: 0x02001910 | FSEQ_CNVR_ID
[ 3495.356777] iwlwifi 0000:36:00.0: 0x02001910 | CNVI_AUX_MISC_CHIP
[ 3495.361619] iwlwifi 0000:36:00.0: 0x02001910 | CNVR_AUX_MISC_CHIP
[ 3495.366456] iwlwifi 0000:36:00.0: 0x8F0F1BED | CNVR_SCU_SD_REGS_SD_REG_DIG_DCDC_VTRIM
[ 3495.373018] iwlwifi 0000:36:00.0: 0x00000000 | CNVR_SCU_SD_REGS_SD_REG_ACTIVE_VDIG_MIRROR
[ 3495.379941] iwlwifi 0000:36:00.0: 0x00570000 | FSEQ_PREV_CNVIO_INIT_VERSION
[ 3495.385643] iwlwifi 0000:36:00.0: 0x00B10006 | FSEQ_WIFI_FSEQ_VERSION
[ 3495.390826] iwlwifi 0000:36:00.0: 0x00B10005 | FSEQ_BT_FSEQ_VERSION
[ 3495.395833] iwlwifi 0000:36:00.0: 0x000000E6 | FSEQ_CLASS_TP_VERSION
[ 3495.401013] iwlwifi 0000:36:00.0: UMAC CURRENT PC: 0x8028b720
[ 3495.405529] iwlwifi 0000:36:00.0: LMAC1 CURRENT PC: 0xd0
[ 3495.409573] iwlwifi 0000:36:00.0: LMAC2 CURRENT PC: 0xd0
[ 3495.413616] iwlwifi 0000:36:00.0: UMAC CURRENT PC 1: 0x8028b71e
[ 3495.418273] iwlwifi 0000:36:00.0: TCM1 CURRENT PC: 0xd0
[ 3495.422241] iwlwifi 0000:36:00.0: RCM1 CURRENT PC: 0xd0
[ 3495.426197] iwlwifi 0000:36:00.0: RCM2 CURRENT PC: 0xd0
[ 3495.430238] iwlwifi 0000:36:00.0: Function Scratch status:
[ 3495.434468] iwlwifi 0000:36:00.0: 0x01010101 | Func Scratch
[ 3496.372015] iwlwifi 0000:36:00.0: Failed to get INIT_COMPLETE -110
[ 3496.376948] iwlwifi 0000:36:00.0: WRT: Collecting data: ini trigger 4 fired (delay=0ms).
[ 3498.129835] iwlwifi 0000:36:00.0: Failed start-fw. ret=-110
[ 3498.134138] ------------[ cut here ]------------
[ 3498.134142] Hardware became unavailable during restart.
[ 3498.134249] WARNING: CPU: 3 PID: 52511 at net/mac80211/util.c:1927 ieee80211_reconfig+0x1df/0x4790 [mac80211]
[ 3498.134445] Modules linked in: vrf nf_conntrack_netlink nf_conntrack nfnetlink nf_defrag_ipv6 nf_defrag_ipv4 8021q garp mrp stp llc macvlan pktgen rfcomm 
rpcrdma rdma_cm iw_cm nfsv3 ib_cm ib_core nfs netfs qrtr bnep snd_hda_codec_intelhdmi snd_hda_codec_hdmi snd_hda_codec_alc662 snd_hda_codec_realtek_lib 
snd_hda_codec_generic ee1004 iTCO_wdt snd_hda_intel intel_rapl_msr intel_pmc_bxt snd_intel_dspcfg iTCO_vendor_support snd_hda_codec coretemp snd_hda_core 
snd_hwdep intel_rapl_common intel_uncore_frequency snd_seq intel_uncore_frequency_common snd_seq_device snd_pcm iwlmld snd_timer intel_tcc_cooling snd i2c_i801 
x86_pkg_temp_thermal i2c_smbus intel_powerclamp pcspkr intel_wmi_thunderbolt soundcore mac80211 i2c_mux btusb btbcm iwlwifi btmtk btrtl btintel bluetooth 
cfg80211 ftdi_sio mei_pxp mei_hdcp intel_pmc_core intel_pch_thermal pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec acpi_pad bfq nfsd 
sch_fq_codel auth_rpcgss nfs_acl lockd grace nfs_localio sunrpc zram raid1 dm_raid raid456
[ 3498.134640]  async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq i915 drm_buddy intel_gtt drm_client_lib drm_display_helper 
drm_kms_helper cec rc_core ttm igb agpgart dca i2c_algo_bit hwmon mei_wdt drm video intel_oc_wdt wmi i2c_core scsi_dh_rdac scsi_dh_emc scsi_dh_alua dm_multipath 
fuse [last unloaded: nfnetlink]
[ 3498.134776] CPU: 3 UID: 0 PID: 52511 Comm: kworker/3:2 Kdump: loaded Tainted: G        W           6.18.14+ #28 PREEMPT(full)
[ 3498.134784] Tainted: [W]=WARN
[ 3498.134787] Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/21/2023
[ 3498.134792] Workqueue: events_freezable ieee80211_restart_work [mac80211]
[ 3498.134914] RIP: 0010:ieee80211_reconfig+0x1df/0x4790 [mac80211]
[ 3498.135012] Code: 89 5c 24 08 e8 42 e6 ec ff 4c 8b 5c 24 08 85 c0 89 04 24 0f 84 a7 08 00 00 48 c7 c7 00 8f 41 a2 4c 89 5c 24 08 e8 b1 1e d1 de <0f> 0b 48 b8 
00 00 00 00 00 fc ff df 4c 8b 5c 24 08 49 8d bb 44 44
[ 3498.135018] RSP: 0018:ffff888163ddfa60 EFLAGS: 00010282
[ 3498.135024] RAX: 0000000000000000 RBX: ffff8881635d2080 RCX: 0000000000000001
[ 3498.135028] RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88841dba4e48
[ 3498.135032] RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffed1083b749c9
[ 3498.135036] R10: ffff88841dba4e4b R11: 00000000000b05e0 R12: ffffed102c6ba1e5
[ 3498.135040] R13: ffff8881635d4d00 R14: ffff8881635d0f28 R15: ffff8881635d52c8
[ 3498.135044] FS:  0000000000000000(0000) GS:ffff8884974c6000(0000) knlGS:0000000000000000
[ 3498.135049] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3498.135052] CR2: 00007f38f1bc2ff8 CR3: 000000000509a003 CR4: 00000000003706f0
[ 3498.135057] Call Trace:
[ 3498.135061]  <TASK>
[ 3498.135066]  ? find_held_lock+0x2b/0x80
[ 3498.135077]  ? schedule+0x2cc/0x3a0
[ 3498.135093]  ? ieee80211_stop_device+0x110/0x110 [mac80211]
[ 3498.135219]  ? synchronize_rcu_expedited+0x379/0x3e0
[ 3498.135227]  ? rcu_exp_wait_wake+0x13c0/0x13c0
[ 3498.135231]  ? do_raw_spin_lock+0x12c/0x270
[ 3498.135240]  ? swake_up_locked+0x1b0/0x1b0
[ 3498.135252]  ? cond_synchronize_rcu_expedited_full+0x90/0x90
[ 3498.135264]  ieee80211_restart_work+0x261/0x3c0 [mac80211]
[ 3498.135376]  process_one_work+0x83f/0x17b0
[ 3498.135392]  ? pwq_dec_nr_in_flight+0xe00/0xe00
[ 3498.135416]  ? ieee80211_ifcomb_check+0x180/0x180 [mac80211]
[ 3498.135513]  worker_thread+0x58c/0xfb0
[ 3498.135524]  ? __kthread_parkme+0xc6/0x1f0
[ 3498.135534]  ? rescuer_thread+0x1340/0x1340
[ 3498.135539]  kthread+0x3b7/0x770
[ 3498.135546]  ? kthread_is_per_cpu+0xb0/0xb0
[ 3498.135550]  ? ret_from_fork+0x17/0x3a0
[ 3498.135557]  ? lock_release+0xce/0x290
[ 3498.135565]  ? kthread_is_per_cpu+0xb0/0xb0
[ 3498.135571]  ret_from_fork+0x28b/0x3a0
[ 3498.135575]  ? kthread_is_per_cpu+0xb0/0xb0
[ 3498.135580]  ret_from_fork_asm+0x11/0x20
[ 3498.135599]  </TASK>
[ 3498.135602] irq event stamp: 163557
[ 3498.135605] hardirqs last  enabled at (163563): [<ffffffff8161233e>] __up_console_sem+0x5e/0x70
[ 3498.135612] hardirqs last disabled at (163568): [<ffffffff81612323>] __up_console_sem+0x43/0x70
[ 3498.135616] softirqs last  enabled at (162518): [<ffffffff81470b5c>] __irq_exit_rcu+0xcc/0x100
[ 3498.135625] softirqs last disabled at (162513): [<ffffffff81470b5c>] __irq_exit_rcu+0xcc/0x100
[ 3498.135630] ---[ end trace 0000000000000000 ]---
[ 3498.135791] wlan11: deauthenticating from 02:58:a4:ff:75:59 by local choice (Reason: 3=DEAUTH_LEAVING)
[ 3498.144135] wlan11: sta-info-move-state to NONE: current state: 4 (NOT AUTH) is invalid
[ 3498.144154] wlan11: HW problem - can not stop rx aggregation for 02:58:a4:ff:75:59 tid 0
[ 3498.144160] wlan11: HW problem - can not stop rx aggregation for 02:58:a4:ff:75:59 tid 4
[ 3498.144165] wlan11: HW problem - can not stop rx aggregation for 02:58:a4:ff:75:59 tid 6
[ 3498.144191] iwlwifi 0000:36:00.0: Failed to trigger RX queues sync (-5)
[ 3498.174792] wlan11: drv-sta-state, sdata-not-in-driver, old_state: 4  new_state: 3
[ 3498.184599] wlan11: failed to remove key (0, 02:58:a4:ff:75:59) from hardware (-5)
[ 3498.192202] wlan11: drv-sta-state, sdata-not-in-driver, old_state: 3  new_state: 2
[ 3498.198503] wlan11: drv-sta-state, sdata-not-in-driver, old_state: 2  new_state: 1
[ 3498.205662] wlan11: drv-sta-state, sdata-not-in-driver, old_state: 1  new_state: 0
[ 3498.214838] ------------[ cut here ]------------
[ 3498.214847] WARNING: CPU: 3 PID: 52511 at net/mac80211/driver-ops.h:1055 ieee80211_del_chanctx+0x336/0x3d0 [mac80211]
[ 3498.215059] Modules linked in: vrf nf_conntrack_netlink nf_conntrack nfnetlink nf_defrag_ipv6 nf_defrag_ipv4 8021q garp mrp stp llc macvlan pktgen rfcomm 
rpcrdma rdma_cm iw_cm nfsv3 ib_cm ib_core nfs netfs qrtr bnep snd_hda_codec_intelhdmi snd_hda_codec_hdmi snd_hda_codec_alc662 snd_hda_codec_realtek_lib 
snd_hda_codec_generic ee1004 iTCO_wdt snd_hda_intel intel_rapl_msr intel_pmc_bxt snd_intel_dspcfg iTCO_vendor_support snd_hda_codec coretemp snd_hda_core 
snd_hwdep intel_rapl_common intel_uncore_frequency snd_seq intel_uncore_frequency_common snd_seq_device snd_pcm iwlmld snd_timer intel_tcc_cooling snd i2c_i801 
x86_pkg_temp_thermal i2c_smbus intel_powerclamp pcspkr intel_wmi_thunderbolt soundcore mac80211 i2c_mux btusb btbcm iwlwifi btmtk btrtl btintel bluetooth 
cfg80211 ftdi_sio mei_pxp mei_hdcp intel_pmc_core intel_pch_thermal pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec acpi_pad bfq nfsd 
sch_fq_codel auth_rpcgss nfs_acl lockd grace nfs_localio sunrpc zram raid1 dm_raid raid456
[ 3498.215403]  async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq i915 drm_buddy intel_gtt drm_client_lib drm_display_helper 
drm_kms_helper cec rc_core ttm igb agpgart dca i2c_algo_bit hwmon mei_wdt drm video intel_oc_wdt wmi i2c_core scsi_dh_rdac scsi_dh_emc scsi_dh_alua dm_multipath 
fuse [last unloaded: nfnetlink]
[ 3498.215521] CPU: 3 UID: 0 PID: 52511 Comm: kworker/3:2 Kdump: loaded Tainted: G        W           6.18.14+ #28 PREEMPT(full)
[ 3498.215529] Tainted: [W]=WARN
[ 3498.215532] Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/21/2023
[ 3498.215537] Workqueue: events_freezable ieee80211_restart_work [mac80211]
[ 3498.215644] RIP: 0010:ieee80211_del_chanctx+0x336/0x3d0 [mac80211]
[ 3498.215856] Code: fe ff ff 80 3d 68 6a a3 ff 00 0f 85 fe fd ff ff 48 c7 c7 60 aa 41 a2 c6 05 54 6a a3 ff 01 e8 a1 41 cf de 0f 0b e9 e4 fd ff ff <0f> 0b 48 c7 
c7 80 ab 41 a2 e8 0c ec ea de e9 65 fe ff ff 48 89 ef
[ 3498.215865] RSP: 0018:ffff888163ddf108 EFLAGS: 00010246
[ 3498.215877] RAX: 0000000000000000 RBX: ffff8881635d0ee0 RCX: 0000000000000000
[ 3498.215884] RDX: 0000000000000004 RSI: ffff8881635d0788 RDI: ffff8881f5f4b718
[ 3498.215891] RBP: ffff88815e94d454 R08: 0000000000000001 R09: 000000005102af7d
[ 3498.215898] R10: ffff8881f5f4ac00 R11: ffff8881f5f4b6a0 R12: ffff88815e94d400
[ 3498.215903] R13: 0000000000000000 R14: ffff8881635d4f00 R15: ffff88815e94d4b0
[ 3498.215907] FS:  0000000000000000(0000) GS:ffff8884974c6000(0000) knlGS:0000000000000000
[ 3498.215912] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3498.215916] CR2: 00007f38f1bc2ff8 CR3: 00000001ca0eb002 CR4: 00000000003706f0
[ 3498.215920] Call Trace:
[ 3498.215925]  <TASK>
[ 3498.215932]  ieee80211_free_chanctx+0x144/0x210 [mac80211]
[ 3498.216047]  __ieee80211_link_release_channel+0x394/0x4a0 [mac80211]
[ 3498.216146]  ieee80211_set_disassoc+0x9dc/0x1c10 [mac80211]
[ 3498.216244]  ? ieee80211_add_link_elems+0x35b0/0x35b0 [mac80211]
[ 3498.216347]  ieee80211_mgd_deauth+0x526/0x1780 [mac80211]
[ 3498.216517]  ? check_irq_usage+0xb5/0xa20
[ 3498.216536]  ? ieee80211_mgd_assoc+0x5be0/0x5be0 [mac80211]
[ 3498.216724]  ? check_path.constprop.0+0x24/0x50
[ 3498.216735]  ? check_noncircular+0x7e/0x140
[ 3498.216755]  ? lock_is_held_type+0xa5/0x110
[ 3498.216773]  cfg80211_mlme_deauth+0x333/0x7a0 [cfg80211]
[ 3498.216975]  ? prb_final_commit+0x40/0x40
[ 3498.216990]  ? cfg80211_mlme_assoc+0x960/0x960 [cfg80211]
[ 3498.217170]  cfg80211_mlme_down+0x16f/0x230 [cfg80211]
[ 3498.217333]  ? cfg80211_mlme_disassoc+0x450/0x450 [cfg80211]
[ 3498.217492]  ? kfree+0x2ae/0x580
[ 3498.217515]  cfg80211_disconnect+0x4d2/0x700 [cfg80211]
[ 3498.217694]  cfg80211_netdev_notifier_call+0x661/0x10a0 [cfg80211]
[ 3498.217855]  ? prb_next_reserve_seq+0x2a0/0x2a0
[ 3498.217869]  ? cfg80211_register_netdevice+0x2a0/0x2a0 [cfg80211]
[ 3498.218022]  ? up+0x102/0x180
[ 3498.218030]  ? __bfs+0x12e/0x220
[ 3498.218035]  ? do_raw_spin_unlock+0x54/0x220
[ 3498.218043]  ? check_irq_usage+0xb5/0xa20
[ 3498.218049]  ? __bfs+0x12e/0x220
[ 3498.218056]  ? check_irq_usage+0xb5/0xa20
[ 3498.218064]  ? check_path.constprop.0+0x24/0x50
[ 3498.218070]  ? __bfs+0x12e/0x220
[ 3498.218094]  ? __lock_acquire+0x432/0x23b0
[ 3498.218107]  ? lock_acquire+0x155/0x2e0
[ 3498.218113]  ? packet_notifier+0xd3/0xa70
[ 3498.218120]  ? find_held_lock+0x2b/0x80
[ 3498.218126]  ? packet_notifier+0x1f0/0xa70
[ 3498.218132]  ? lock_release+0xce/0x290
[ 3498.218140]  ? packet_notifier+0x1fa/0xa70
[ 3498.218149]  ? packet_getname_spkt+0x290/0x290
[ 3498.218154]  ? lock_is_held_type+0xa5/0x110
[ 3498.218166]  notifier_call_chain+0x97/0x280
[ 3498.218178]  __dev_close_many+0xe8/0x670
[ 3498.218187]  ? netdev_notify_peers+0x20/0x20
[ 3498.218194]  ? try_to_wake_up+0xa09/0x1450
[ 3498.218206]  netif_close_many+0x1e6/0x5c0
[ 3498.218215]  ? __dev_close_many+0x670/0x670
[ 3498.218222]  ? wake_up_q+0xaf/0x130
[ 3498.218231]  netif_close+0x141/0x1d0
[ 3498.218237]  ? netif_close_many+0x5c0/0x5c0
[ 3498.218249]  dev_close+0x89/0x1f0
[ 3498.218255]  cfg80211_shutdown_all_interfaces+0x76/0x190 [cfg80211]
[ 3498.218344]  ieee80211_restart_work+0x2c8/0x3c0 [mac80211]
[ 3498.218440]  process_one_work+0x83f/0x17b0
[ 3498.218455]  ? pwq_dec_nr_in_flight+0xe00/0xe00
[ 3498.218466]  ? ieee80211_ifcomb_check+0x180/0x180 [mac80211]
[ 3498.218562]  worker_thread+0x58c/0xfb0
[ 3498.218573]  ? __kthread_parkme+0xc6/0x1f0
[ 3498.218582]  ? rescuer_thread+0x1340/0x1340
[ 3498.218588]  kthread+0x3b7/0x770
[ 3498.218594]  ? kthread_is_per_cpu+0xb0/0xb0
[ 3498.218599]  ? ret_from_fork+0x17/0x3a0
[ 3498.218605]  ? lock_release+0xce/0x290
[ 3498.218612]  ? kthread_is_per_cpu+0xb0/0xb0
[ 3498.218619]  ret_from_fork+0x28b/0x3a0
[ 3498.218624]  ? kthread_is_per_cpu+0xb0/0xb0
[ 3498.218629]  ret_from_fork_asm+0x11/0x20
[ 3498.218646]  </TASK>
[ 3498.218649] irq event stamp: 168549
[ 3498.218652] hardirqs last  enabled at (168555): [<ffffffff8161233e>] __up_console_sem+0x5e/0x70
[ 3498.218658] hardirqs last disabled at (168560): [<ffffffff81612323>] __up_console_sem+0x43/0x70
[ 3498.218663] softirqs last  enabled at (167244): [<ffffffffa261e604>] __cleanup_single_sta+0x224/0x530 [mac80211]
[ 3498.218797] softirqs last disabled at (167242): [<ffffffffa271ee1d>] ieee80211_txq_purge+0x1bd/0x3c0 [mac80211]
[ 3498.218893] ---[ end trace 0000000000000000 ]---
[ 3498.219198] drv-remove-chanctx, NOT driver_present, not sending request to driver.
[ 3498.219208] ==================================================================
[ 3498.231427] BUG: KASAN: slab-use-after-free in iwl_mld_mac80211_flush+0x2c6/0x330 [iwlmld]
[ 3498.238423] Read of size 8 at addr ffff88813ef850a8 by task kworker/3:2/52511
[ 3498.244271]
[ 3498.244477] CPU: 3 UID: 0 PID: 52511 Comm: kworker/3:2 Kdump: loaded Tainted: G        W           6.18.14+ #28 PREEMPT(full)
[ 3498.244483] Tainted: [W]=WARN
[ 3498.244484] Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/21/2023
[ 3498.244486] Workqueue: events_freezable ieee80211_restart_work [mac80211]
[ 3498.244599] Call Trace:
[ 3498.244601]  <TASK>
[ 3498.244603]  dump_stack_lvl+0x73/0xa0
[ 3498.244609]  print_report+0xce/0x620
[ 3498.244615]  ? __virt_addr_valid+0x205/0x3f0
[ 3498.244620]  ? iwl_mld_mac80211_flush+0x2c6/0x330 [iwlmld]
[ 3498.244643]  kasan_report+0xc6/0xf0
[ 3498.244648]  ? iwl_mld_mac80211_flush+0x2c6/0x330 [iwlmld]
[ 3498.244666]  iwl_mld_mac80211_flush+0x2c6/0x330 [iwlmld]
[ 3498.244690]  __ieee80211_flush_queues+0x4e4/0x950 [mac80211]
[ 3498.244787]  ? ieee80211_get_vif_queues+0x270/0x270 [mac80211]
[ 3498.244880]  ? printk_get_console_flush_type+0x2d0/0x2d0
[ 3498.244884]  ? lock_is_held_type+0xa5/0x110
[ 3498.244890]  __ieee80211_recalc_idle+0x375/0x4a0 [mac80211]
[ 3498.244982]  ieee80211_recalc_idle+0x10/0x30 [mac80211]
[ 3498.245074]  ieee80211_del_chanctx+0x27d/0x3d0 [mac80211]
[ 3498.245167]  ieee80211_free_chanctx+0x144/0x210 [mac80211]
[ 3498.245260]  __ieee80211_link_release_channel+0x394/0x4a0 [mac80211]
[ 3498.245353]  ieee80211_set_disassoc+0x9dc/0x1c10 [mac80211]
[ 3498.245444]  ? ieee80211_add_link_elems+0x35b0/0x35b0 [mac80211]
[ 3498.245534]  ieee80211_mgd_deauth+0x526/0x1780 [mac80211]
[ 3498.245622]  ? check_irq_usage+0xb5/0xa20
[ 3498.245627]  ? ieee80211_mgd_assoc+0x5be0/0x5be0 [mac80211]
[ 3498.245728]  ? check_path.constprop.0+0x24/0x50
[ 3498.245732]  ? check_noncircular+0x7e/0x140
[ 3498.245737]  ? lock_is_held_type+0xa5/0x110
[ 3498.245742]  cfg80211_mlme_deauth+0x333/0x7a0 [cfg80211]
[ 3498.245858]  ? prb_final_commit+0x40/0x40
[ 3498.245863]  ? cfg80211_mlme_assoc+0x960/0x960 [cfg80211]
[ 3498.245949]  cfg80211_mlme_down+0x16f/0x230 [cfg80211]
[ 3498.246034]  ? cfg80211_mlme_disassoc+0x450/0x450 [cfg80211]
[ 3498.246116]  ? kfree+0x2ae/0x580
[ 3498.246123]  cfg80211_disconnect+0x4d2/0x700 [cfg80211]
[ 3498.246208]  cfg80211_netdev_notifier_call+0x661/0x10a0 [cfg80211]
[ 3498.246291]  ? prb_next_reserve_seq+0x2a0/0x2a0
[ 3498.246295]  ? cfg80211_register_netdevice+0x2a0/0x2a0 [cfg80211]
[ 3498.246378]  ? up+0x102/0x180
[ 3498.246382]  ? __bfs+0x12e/0x220
[ 3498.246385]  ? do_raw_spin_unlock+0x54/0x220
[ 3498.246390]  ? check_irq_usage+0xb5/0xa20
[ 3498.246394]  ? __bfs+0x12e/0x220
[ 3498.246398]  ? check_irq_usage+0xb5/0xa20
[ 3498.246402]  ? check_path.constprop.0+0x24/0x50
[ 3498.246405]  ? __bfs+0x12e/0x220
[ 3498.246410]  ? __lock_acquire+0x432/0x23b0
[ 3498.246417]  ? lock_acquire+0x155/0x2e0
[ 3498.246420]  ? packet_notifier+0xd3/0xa70
[ 3498.246425]  ? find_held_lock+0x2b/0x80
[ 3498.246428]  ? packet_notifier+0x1f0/0xa70
[ 3498.246432]  ? lock_release+0xce/0x290
[ 3498.246436]  ? packet_notifier+0x1fa/0xa70
[ 3498.246440]  ? packet_getname_spkt+0x290/0x290
[ 3498.246443]  ? lock_is_held_type+0xa5/0x110
[ 3498.246449]  notifier_call_chain+0x97/0x280
[ 3498.246456]  __dev_close_many+0xe8/0x670
[ 3498.246461]  ? netdev_notify_peers+0x20/0x20
[ 3498.246466]  ? try_to_wake_up+0xa09/0x1450
[ 3498.246472]  netif_close_many+0x1e6/0x5c0
[ 3498.246477]  ? __dev_close_many+0x670/0x670
[ 3498.246481]  ? wake_up_q+0xaf/0x130
[ 3498.246486]  netif_close+0x141/0x1d0
[ 3498.246489]  ? netif_close_many+0x5c0/0x5c0
[ 3498.246495]  dev_close+0x89/0x1f0
[ 3498.246498]  cfg80211_shutdown_all_interfaces+0x76/0x190 [cfg80211]
[ 3498.246639]  ieee80211_restart_work+0x2c8/0x3c0 [mac80211]
[ 3498.246751]  process_one_work+0x83f/0x17b0
[ 3498.246758]  ? pwq_dec_nr_in_flight+0xe00/0xe00
[ 3498.246763]  ? ieee80211_ifcomb_check+0x180/0x180 [mac80211]
[ 3498.246887]  worker_thread+0x58c/0xfb0
[ 3498.246893]  ? __kthread_parkme+0xc6/0x1f0
[ 3498.246898]  ? rescuer_thread+0x1340/0x1340
[ 3498.246901]  kthread+0x3b7/0x770
[ 3498.246904]  ? kthread_is_per_cpu+0xb0/0xb0
[ 3498.246907]  ? ret_from_fork+0x17/0x3a0
[ 3498.246911]  ? lock_release+0xce/0x290
[ 3498.246915]  ? kthread_is_per_cpu+0xb0/0xb0
[ 3498.246918]  ret_from_fork+0x28b/0x3a0
[ 3498.246921]  ? kthread_is_per_cpu+0xb0/0xb0
[ 3498.246924]  ret_from_fork_asm+0x11/0x20
[ 3498.246932]  </TASK>
[ 3498.246933]
[ 3498.519343] Allocated by task 57169:
[ 3498.521634]  kasan_save_stack+0x1c/0x40
[ 3498.521644]  kasan_save_track+0x10/0x30
[ 3498.521648]  __kasan_kmalloc+0x83/0x90
[ 3498.521652]  __kmalloc_noprof+0x24e/0x7d0
[ 3498.521657]  __sta_info_alloc+0x9c/0x1980 [mac80211]
[ 3498.521817]  ieee80211_prep_connection+0x1e3/0x1550 [mac80211]
[ 3498.521919]  ieee80211_mgd_auth+0xec6/0x1960 [mac80211]
[ 3498.522034]  cfg80211_mlme_auth+0x458/0x7f0 [cfg80211]
[ 3498.522154]  nl80211_authenticate+0xa90/0x1180 [cfg80211]
[ 3498.522249]  genl_family_rcv_msg_doit+0x1cb/0x2a0
[ 3498.522255]  genl_rcv_msg+0x3f7/0x6b0
[ 3498.522258]  netlink_rcv_skb+0x125/0x380
[ 3498.522261]  genl_rcv+0x24/0x40
[ 3498.522265]  netlink_unicast+0x5dd/0x9d0
[ 3498.522268]  netlink_sendmsg+0x749/0xc00
[ 3498.522271]  __sock_sendmsg+0xc1/0x150
[ 3498.522277]  ____sys_sendmsg+0x5f4/0x8f0
[ 3498.522281]  ___sys_sendmsg+0xed/0x170
[ 3498.522285]  __sys_sendmsg+0x107/0x1a0
[ 3498.522288]  do_syscall_64+0x69/0x1210
[ 3498.522294]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 3498.522299]
[ 3498.522508] Freed by task 52511:
[ 3498.524450]  kasan_save_stack+0x1c/0x40
[ 3498.524456]  kasan_save_track+0x10/0x30
[ 3498.524460]  __kasan_save_free_info+0x37/0x50
[ 3498.524464]  __kasan_slab_free+0x3b/0x60
[ 3498.524468]  kfree+0x164/0x580
[ 3498.524473]  __sta_info_flush+0x409/0x610 [mac80211]
[ 3498.524568]  ieee80211_set_disassoc+0x14fb/0x1c10 [mac80211]
[ 3498.524658]  ieee80211_mgd_deauth+0x526/0x1780 [mac80211]
[ 3498.524762]  cfg80211_mlme_deauth+0x333/0x7a0 [cfg80211]
[ 3498.524888]  cfg80211_mlme_down+0x16f/0x230 [cfg80211]
[ 3498.524983]  cfg80211_disconnect+0x4d2/0x700 [cfg80211]
[ 3498.525065]  cfg80211_netdev_notifier_call+0x661/0x10a0 [cfg80211]
[ 3498.525173]  notifier_call_chain+0x97/0x280
[ 3498.525179]  __dev_close_many+0xe8/0x670
[ 3498.525184]  netif_close_many+0x1e6/0x5c0
[ 3498.525188]  netif_close+0x141/0x1d0
[ 3498.525192]  dev_close+0x89/0x1f0
[ 3498.525196]  cfg80211_shutdown_all_interfaces+0x76/0x190 [cfg80211]
[ 3498.525277]  ieee80211_restart_work+0x2c8/0x3c0 [mac80211]
[ 3498.525365]  process_one_work+0x83f/0x17b0
[ 3498.525370]  worker_thread+0x58c/0xfb0
[ 3498.525373]  kthread+0x3b7/0x770
[ 3498.525377]  ret_from_fork+0x28b/0x3a0
[ 3498.525394]  ret_from_fork_asm+0x11/0x20
[ 3498.525400]
[ 3498.525610] The buggy address belongs to the object at ffff88813ef84000
  which belongs to the cache kmalloc-8k of size 8192
[ 3498.535533] The buggy address is located 4264 bytes inside of
  freed 8192-byte region [ffff88813ef84000, ffff88813ef86000)
[ 3498.545368]
[ 3498.545577] The buggy address belongs to the physical page:
[ 3498.549863] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13ef80
[ 3498.549868] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 3498.549871] anon flags: 0x5fff8000000040(head|node=0|zone=2|lastcpupid=0x3fff)
[ 3498.549877] page_type: f5(slab)
[ 3498.549882] raw: 005fff8000000040 ffff888120043180 ffffea0005cb8600 0000000000000005
[ 3498.549885] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 3498.549889] head: 005fff8000000040 ffff888120043180 ffffea0005cb8600 0000000000000005
[ 3498.549893] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 3498.549896] head: 005fff8000000003 ffffea0004fbe001 00000000ffffffff 00000000ffffffff
[ 3498.549899] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000
[ 3498.549902] page dumped because: kasan: bad access detected
[ 3498.549905]
[ 3498.550110] Memory state around the buggy address:
[ 3498.553615]  ffff88813ef84f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 3498.559547]  ffff88813ef85000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 3498.565482] >ffff88813ef85080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 3498.571409]                                   ^
[ 3498.574652]  ffff88813ef85100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 3498.580588]  ffff88813ef85180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 3498.586522] ==================================================================
[ 3498.629921] Disabling lock debugging due to kernel taint: 0x5 (lockdep)

Thanks,
Ben