kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi
Hello,
I get a kernel panic when unbinding device (8086:0085) from the iwlwifi driver (via writing to the "unbind" file in sysfs), while the wifi connection is active. I can reproduce it on Thinkpad X230, but other devices might be affected too. The specific crash is:
[ 286.908182] kernel BUG at mm/slub.c:634!
[ 286.908201] Oops: invalid opcode: 0000 [#1] SMP PTI
[ 286.908221] CPU: 1 UID: 0 PID: 1959 Comm: prepare-suspend Not tainted 6.18.15-1.qubes.fc41.x86_64 #1 PREEMPT(full)
[ 286.908255] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026
[ 286.908275] RIP: 0010:kfree+0x3a8/0x470
[ 286.908292] Code: 5d 41 5e 41 5f 5d e9 67 bb ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da 4c 89 ee 4c 89 e7 e8 ad 2c 00 00 e9 bd fd ff ff <0f> 0b 89 c8 4c 8d 04 03 40 f6 c6 80 0f 84 41 ff ff ff 83 e6 08 0f
[ 286.908347] RSP: 0018:ffffcfce8280bb50 EFLAGS: 00010246
[ 286.908365] RAX: ffff8b2dcef2c800 RBX: ffff8b2dcef2c800 RCX: ffff8b2dcef2c830
[ 286.908389] RDX: 00000000000be001 RSI: 0000000000000000 RDI: ffff8b2dcef2c880
[ 286.908414] RBP: ffffcfce8280bba0 R08: ffff8b2dcef2c860 R09: 0000000000000000
[ 286.908438] R10: ffff8b2dcef2c860 R11: 0000000000000000 R12: ffff8b2dd2841600
[ 286.908462] R13: fffff077003bcb00 R14: ffffffffc093c480 R15: 0000000000000060
[ 286.908487] FS: 00007b10286cd740(0000) GS:ffff8b2e19c6c000(0000) knlGS:0000000000000000
[ 286.908511] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 286.908532] CR2: 00007fb93027bc70 CR3: 00000000034f0005 CR4: 00000000001706f0
[ 286.908559] Call Trace:
[ 286.908570] <TASK>
[ 286.908581] ? _raw_spin_unlock_bh+0xe/0x20
[ 286.908599] iwl_pcie_txq_free+0x130/0x170 [iwlwifi]
[ 286.908644] iwl_pcie_tx_free+0x66/0xe0 [iwlwifi]
[ 286.908681] iwl_trans_pcie_free+0x1df/0x250 [iwlwifi]
[ 286.908719] pci_device_remove+0x42/0xb0
[ 286.908736] device_release_driver_internal+0x19c/0x200
[ 286.908755] unbind_store+0xa1/0xb0
[ 286.908771] kernfs_fop_write_iter+0x150/0x200
[ 286.908790] vfs_write+0x25d/0x450
[ 286.908806] ksys_write+0x6b/0xe0
[ 286.908825] do_syscall_64+0x84/0x800
[ 286.908842] ? syscall_exit_work+0x108/0x140
[ 286.908861] ? do_syscall_64+0xbb/0x800
[ 286.908876] ? ksys_dup3+0x63/0xf0
[ 286.908892] ? syscall_exit_work+0x108/0x140
[ 286.911388] ? do_syscall_64+0xbb/0x800
[ 286.911408] ? do_sys_openat2+0xa4/0xe0
[ 286.911423] ? syscall_exit_work+0x108/0x140
[ 286.911443] ? do_syscall_64+0xbb/0x800
[ 286.911458] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 286.911477] RIP: 0033:0x7b102873ec5e
[ 286.911493] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa
[ 286.911549] RSP: 002b:00007ffd94bc3100 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[ 286.911575] RAX: ffffffffffffffda RBX: 00007b10288ba5c0 RCX: 00007b102873ec5e
[ 286.911600] RDX: 000000000000000d RSI: 00006385db4f8020 RDI: 0000000000000001
[ 286.911625] RBP: 00007ffd94bc3110 R08: 0000000000000000 R09: 0000000000000000
[ 286.911650] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000d
[ 286.911674] R13: 000000000000000d R14: 00006385db4f8020 R15: 00006385db4f5b30
[ 286.911701] </TASK>
[ 286.911711] Modules linked in: iwldvm iwlwifi mac80211 ehci_pci ehci_hcd nft_nat nft_flow_offload nf_flow_table_inet nf_flow_table qrtr nf_conntrack_netlink nft_reject_ipv6 nf_reject_ipv6 nft_reject_ipv4 nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables joydev libarc4 intel_rapl_msr intel_rapl_common polyval_clmulni ghash_clmulni_intel cfg80211 e1000e ata_generic rfkill i2c_piix4 pata_acpi i2c_smbus pcspkr floppy vfat fat serio_raw xen_scsiback target_core_mod xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback xen_evtchn i2c_dev fuse loop nfnetlink overlay xen_blkfront [last unloaded: iwlwifi]
[ 286.911967] ---[ end trace 0000000000000000 ]---This is running in a VM (HVM) under Xen, with relevant PCI device attached, but I don't think it's relevant for this bug.
I've got reports about the issue in Linux 6.18.15 initially (after updating from 6.12), but later tests identified it's a regression somewhere between 6.15.11 and 6.16.8.
The crash still happen on 7.0.14, although it looks different there:
[ 106.379541] ------------[ cut here ]------------
[ 106.379572] kernel BUG at mm/slub.c:542!
[ 106.379596] Oops: invalid opcode: 0000 [#1] SMP PTI
[ 106.379618] CPU: 1 UID: 0 PID: 240 Comm: kworker/1:2 Not tainted 7.0.14-1.qubes.fc41.x86_64 #1 PREEMPT(full)
[ 106.379656] Hardware name: Xen HVM domU, BIOS 4.19.4 06/09/2026
[ 106.379680] Workqueue: slub_flushwq flush_cpu_sheaves
[ 106.379711] RIP: 0010:build_detached_freelist+0x1d0/0x210
[ 106.379733] Code: 41 5c 41 5d c3 cc cc cc cc 31 d2 4d 85 c0 0f 85 b2 fe ff ff 48 89 04 24 e8 7d fd ff ff 48 c7 03 00 00 00 00 48 8b 04 24 eb d0 <0f> 0b 48 85 d2 74 e3 48 89 13 4c 8b 42 08 e9 8c fe ff ff 0f 0b 31
[ 106.379795] RSP: 0000:ffffcebd804c3c88 EFLAGS: 00010246
[ 106.379815] RAX: 000000000000001d RBX: ffffcebd804c3cb8 RCX: ffff8e6240fcf000
[ 106.379843] RDX: ffff8e6240fcf000 RSI: 000000000000001d RDI: 0000000000000003
[ 106.379870] RBP: ffffffff80000000 R08: 0000000080000000 R09: ffff8e6240fcf030
[ 106.379898] R10: ffffcebd804c3d10 R11: 0000000000000000 R12: ffff8e6242a68b00
[ 106.379925] R13: ffff8e6242a68aff R14: 000000000000001c R15: 0000000000000000
[ 106.379953] FS: 0000000000000000(0000) GS:ffff8e62a837a000(0000) knlGS:0000000000000000
[ 106.379981] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 106.380004] CR2: 0000767e599f2fd0 CR3: 000000000c1d2001 CR4: 00000000001706f0
[ 106.380035] Call Trace:
[ 106.380047] <TASK>
[ 106.380060] __kmem_cache_free_bulk.part.0+0x60/0xe0
[ 106.380085] __sheaf_flush_main_batch+0xa1/0xe0
[ 106.380110] flush_cpu_sheaves+0xc3/0xe0
[ 106.380129] process_one_work+0x198/0x390
[ 106.380149] worker_thread+0x1af/0x320
[ 106.380168] ? __pfx_worker_thread+0x10/0x10
[ 106.380190] kthread+0xe3/0x120
[ 106.380207] ? __pfx_kthread+0x10/0x10
[ 106.380223] ret_from_fork+0x19e/0x260
[ 106.380241] ? __pfx_kthread+0x10/0x10
[ 106.380257] ret_from_fork_asm+0x1a/0x30
[ 106.380276] </TASK>
[ 106.380287] Modules linked in: nft_nat nft_flow_offload nf_flow_table_inet nf_flow_table nf_conntrack_netlink nft_reject_ipv6 nf_reject_ipv6 qrtr nft_reject_ipv4 nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables vfat fat intel_rapl_msr iwldvm intel_rapl_common ghash_clmulni_intel mac80211 libarc4 iwlwifi joydev cfg80211 ehci_pci pcspkr e1000e ehci_hcd rfkill floppy ata_generic i2c_piix4 pata_acpi i2c_smbus serio_raw xen_scsiback target_core_mod xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback xen_evtchn i2c_dev loop fuse nfnetlink zram lz4hc_compress lz4_compress overlay xen_blkfront
[ 106.381851] ---[ end trace 0000000000000000 ]---This one doesn't have obvious relation to iwlwifi, but I suspect it's at least related.
There are some more call traces at
https://github.com/QubesOS/qubes-issues/issues/10845 but they look pretty similar.
Signature · 3 lines
Best Regards, Marek Marczykowski-Górecki Invisible Things Lab
Korenblit, Miriam Rachel
maintainerQuoted 90 lines
-----Original Message-----
From: Marek Marczykowski-Górecki <[email protected]>
Sent: Wednesday, July 15, 2026 5:33 PM
To: Korenblit, Miriam Rachel <[email protected]>
Cc: [email protected]; [email protected]
Subject: kernel BUG atmm/slub.c:634(kfree) when unbinding device from iwlwifiHello,
I get a kernel panic when unbinding device (8086:0085) from the iwlwifi driver (via writing to the "unbind" file in sysfs), while the wifi connection is active. I can reproduce it on Thinkpad X230, but other devices might be affected too. The specific crash is:
[ 286.908182] kernel BUG at mm/slub.c:634! [ 286.908201] Oops: invalid opcode: 0000 [#1] SMP PTI [ 286.908221] CPU: 1 UID: 0 PID: 1959 Comm: prepare-suspend Not tainted 6.18.15-1.qubes.fc41.x86_64 #1 PREEMPT(full) [ 286.908255] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026 [ 286.908275] RIP: 0010:kfree+0x3a8/0x470 [ 286.908292] Code: 5d 41 5e 41 5f 5d e9 67 bb ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da 4c 89 ee 4c 89 e7 e8 ad 2c 00 00 e9 bd fd ff ff <0f> 0b 89 c8 4c 8d 04 03 40 f6 c6 80 0f 84 41 ff ff ff 83 e6 08 0f [ 286.908347] RSP: 0018:ffffcfce8280bb50 EFLAGS: 00010246 [ 286.908365] RAX: ffff8b2dcef2c800 RBX: ffff8b2dcef2c800 RCX: ffff8b2dcef2c830 [ 286.908389] RDX: 00000000000be001 RSI: 0000000000000000 RDI: ffff8b2dcef2c880 [ 286.908414] RBP: ffffcfce8280bba0 R08: ffff8b2dcef2c860 R09: 0000000000000000 [ 286.908438] R10: ffff8b2dcef2c860 R11: 0000000000000000 R12: ffff8b2dd2841600 [ 286.908462] R13: fffff077003bcb00 R14: ffffffffc093c480 R15: 0000000000000060 [ 286.908487] FS: 00007b10286cd740(0000) GS:ffff8b2e19c6c000(0000) knlGS:0000000000000000 [ 286.908511] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.908532] CR2: 00007fb93027bc70 CR3: 00000000034f0005 CR4: 00000000001706f0 [ 286.908559] Call Trace: [ 286.908570] <TASK> [ 286.908581] ? _raw_spin_unlock_bh+0xe/0x20 [ 286.908599] iwl_pcie_txq_free+0x130/0x170 [iwlwifi] [ 286.908644] iwl_pcie_tx_free+0x66/0xe0 [iwlwifi] [ 286.908681] iwl_trans_pcie_free+0x1df/0x250 [iwlwifi] [ 286.908719] pci_device_remove+0x42/0xb0 [ 286.908736] device_release_driver_internal+0x19c/0x200 [ 286.908755] unbind_store+0xa1/0xb0 [ 286.908771] kernfs_fop_write_iter+0x150/0x200 [ 286.908790] vfs_write+0x25d/0x450 [ 286.908806] ksys_write+0x6b/0xe0 [ 286.908825] do_syscall_64+0x84/0x800 [ 286.908842] ? syscall_exit_work+0x108/0x140 [ 286.908861] ? do_syscall_64+0xbb/0x800 [ 286.908876] ? ksys_dup3+0x63/0xf0 [ 286.908892] ? syscall_exit_work+0x108/0x140 [ 286.911388] ? do_syscall_64+0xbb/0x800 [ 286.911408] ? do_sys_openat2+0xa4/0xe0 [ 286.911423] ? syscall_exit_work+0x108/0x140 [ 286.911443] ? do_syscall_64+0xbb/0x800 [ 286.911458] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 286.911477] RIP: 0033:0x7b102873ec5e [ 286.911493] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa [ 286.911549] RSP: 002b:00007ffd94bc3100 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 286.911575] RAX: ffffffffffffffda RBX: 00007b10288ba5c0 RCX: 00007b102873ec5e [ 286.911600] RDX: 000000000000000d RSI: 00006385db4f8020 RDI: 0000000000000001 [ 286.911625] RBP: 00007ffd94bc3110 R08: 0000000000000000 R09: 0000000000000000 [ 286.911650] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000d [ 286.911674] R13: 000000000000000d R14: 00006385db4f8020 R15: 00006385db4f5b30 [ 286.911701] </TASK> [ 286.911711] Modules linked in: iwldvm iwlwifi mac80211 ehci_pci ehci_hcd
nft_natnft_flow_offloadnf_flow_table_inetnf_flow_tableqrtrnf_conntrack_netlinknft_reject_ipv6nf_reject_ipv6nft_reject_ipv4nf_reject_ipv4nft_rejectnft_ctnft_masqnft_chain_natnf_natnf_conntracknf_defrag_ipv6nf_defrag_ipv4nf_tablesjoydev libarc4intel_rapl_msrintel_rapl_commonpolyval_clmulnighash_clmulni_intelcfg80211 e1000eata_genericrfkilli2c_piix4pata_acpii2c_smbuspcspkr floppy vfat fatserio_rawxen_scsibacktarget_core_modxen_netbackxen_privcmdxen_gntdevxen_gntallocxen_blkbackxen_evtchni2c_devfuse loop nfnetlink overlayxen_blkfront[last unloaded: iwlwifi]
Quoted 8 lines
[ 286.911967] ---[ end trace 0000000000000000 ]---This is running in a VM (HVM) under Xen, with relevant PCI device attached, but I don't think it's relevant for this bug.
I've got reports about the issue in Linux 6.18.15 initially (after updating from 6.12), but later tests identified it's a regression somewhere between 6.15.11 and 6.16.8.
Hi, could you please test the attached patch?
It is based on 6.18
Quoted 57 lines
The crash still happen on 7.0.14, although it looks different there:
[ 106.379541] ------------[ cut here ]------------ [ 106.379572] kernel BUG at mm/slub.c:542! [ 106.379596] Oops: invalid opcode: 0000 [#1] SMP PTI [ 106.379618] CPU: 1 UID: 0 PID: 240 Comm: kworker/1:2 Not tainted 7.0.14- 1.qubes.fc41.x86_64 #1 PREEMPT(full) [ 106.379656] Hardware name: Xen HVM domU, BIOS 4.19.4 06/09/2026 [ 106.379680] Workqueue: slub_flushwq flush_cpu_sheaves [ 106.379711] RIP: 0010:build_detached_freelist+0x1d0/0x210 [ 106.379733] Code: 41 5c 41 5d c3 cc cc cc cc 31 d2 4d 85 c0 0f 85 b2 fe ff ff 48 89 04 24 e8 7d fd ff ff 48 c7 03 00 00 00 00 48 8b 04 24 eb d0 <0f> 0b 48 85 d2 74 e3 48 89 13 4c 8b 42 08 e9 8c fe ff ff 0f 0b 31 [ 106.379795] RSP: 0000:ffffcebd804c3c88 EFLAGS: 00010246 [ 106.379815] RAX: 000000000000001d RBX: ffffcebd804c3cb8 RCX: ffff8e6240fcf000 [ 106.379843] RDX: ffff8e6240fcf000 RSI: 000000000000001d RDI: 0000000000000003 [ 106.379870] RBP: ffffffff80000000 R08: 0000000080000000 R09: ffff8e6240fcf030 [ 106.379898] R10: ffffcebd804c3d10 R11: 0000000000000000 R12: ffff8e6242a68b00 [ 106.379925] R13: ffff8e6242a68aff R14: 000000000000001c R15: 0000000000000000 [ 106.379953] FS: 0000000000000000(0000) GS:ffff8e62a837a000(0000) knlGS:0000000000000000 [ 106.379981] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 106.380004] CR2: 0000767e599f2fd0 CR3: 000000000c1d2001 CR4: 00000000001706f0 [ 106.380035] Call Trace: [ 106.380047] <TASK> [ 106.380060] __kmem_cache_free_bulk.part.0+0x60/0xe0 [ 106.380085] __sheaf_flush_main_batch+0xa1/0xe0 [ 106.380110] flush_cpu_sheaves+0xc3/0xe0 [ 106.380129] process_one_work+0x198/0x390 [ 106.380149] worker_thread+0x1af/0x320 [ 106.380168] ? __pfx_worker_thread+0x10/0x10 [ 106.380190] kthread+0xe3/0x120 [ 106.380207] ? __pfx_kthread+0x10/0x10 [ 106.380223] ret_from_fork+0x19e/0x260 [ 106.380241] ? __pfx_kthread+0x10/0x10 [ 106.380257] ret_from_fork_asm+0x1a/0x30 [ 106.380276] </TASK> [ 106.380287] Modules linked in: nft_nat nft_flow_offload nf_flow_table_inet
nf_flow_tablenf_conntrack_netlinknft_reject_ipv6nf_reject_ipv6qrtrnft_reject_ipv4nf_reject_ipv4nft_rejectnft_ctnft_masqnft_chain_natnf_natnf_conntracknf_defrag_ipv6nf_defrag_ipv4nf_tablesvfat fatintel_rapl_msriwldvmintel_rapl_commonghash_clmulni_intelmac80211 libarc4 iwlwifi joydev cfg80211ehci_pcipcspkr e1000eehci_hcdrfkill floppyata_generici2c_piix4pata_acpii2c_smbusserio_rawxen_scsibacktarget_core_modxen_netbackxen_privcmdxen_gntdevxen_gntallocxen_blkbackxen_evtchni2c_devloop fuse nfnetlink zramlz4hc_compresslz4_compressoverlayxen_blkfront[ 106.381851] ---[ end trace 0000000000000000 ]---This one doesn't have obvious relation to iwlwifi, but I suspect it's at least related.
Quoted 8 lines
There are some more call traces at
https://github.com/QubesOS/qubes-issues/issues/10845 but they look pretty similar.--
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
From 519b527a9b83fd072e74611176b08170709e4001 Mon Sep 17 00:00:00 2001
From: Miri Korenblit <[email protected]>
Date: Wed, 15 Jul 2026 20:19:33 +0300
Subject: [PATCH] wifi: iwlwifi: trans: don't memset trans::conf when it is
still needed
Organization: Intel Israel (74) Limited
Currently, trans::conf is cleared in opmode_leave(), which means that in the rest of the remove() it will be zeroed.
But some of the freeing code still needs some data from it, for example the cmd_queue id.
For older devices that their cmd_queue id is not 0, it can cause us to free queue 0 as it was a command queue.
A command queue is different from a regular queue, the first has its cmd as regular kmalloc'ed memory while a regular queue has it from a kmem_cache, so the two should be freed differently.
To avoid that, clear the trans::conf before we call the opmode instead.
--- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 ++ drivers/net/wireless/intel/iwlwifi/iwl-trans.c | 1 - 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/iwl-drv.c +2 -0
@@ -1549,6 +1549,8 @@ _iwl_op_mode_start(struct iwl_drv *drv, struct iwlwifi_opmode_table *op) dbgfs_dir = drv->dbgfs_op_mode;#endif +memset (&drv->trans->conf,0 ,sizeof (drv->trans->conf)); + op_mode = ops->start (drv->trans, drv->trans->cfg, &drv->fw, dbgfs_dir);
drivers/net/wireless/intel/iwlwifi/iwl-trans.c +0 -1
@@ -423,7 +423,6 @@ void iwl_trans_op_mode_leave(struct iwl_trans *trans)cancel_delayed_work_sync (&trans->restart.wk); trans->op_mode =NULL ; -memset (&trans->conf,0 ,sizeof (trans->conf)); trans->state =IWL_TRANS_NO_FW ; }
Signature · 1 line
2.34.1
Marek Marczykowski-Górecki
Tested-byQuoted 95 lines · Miriam Rachel
Quoted 95 lines
-----Original Message-----
From: Marek Marczykowski-Górecki <[email protected]>
Sent: Wednesday, July 15, 2026 5:33 PM
To: Korenblit, Miriam Rachel <[email protected]>
Cc: [email protected]; [email protected]
Subject: kernel BUG atmm/slub.c:634(kfree) when unbinding device from iwlwifiHello,
I get a kernel panic when unbinding device (8086:0085) from the iwlwifi driver (via writing to the "unbind" file in sysfs), while the wifi connection is active. I can reproduce it on Thinkpad X230, but other devices might be affected too. The specific crash is:
[ 286.908182] kernel BUG at mm/slub.c:634! [ 286.908201] Oops: invalid opcode: 0000 [#1] SMP PTI [ 286.908221] CPU: 1 UID: 0 PID: 1959 Comm: prepare-suspend Not tainted 6.18.15-1.qubes.fc41.x86_64 #1 PREEMPT(full) [ 286.908255] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026 [ 286.908275] RIP: 0010:kfree+0x3a8/0x470 [ 286.908292] Code: 5d 41 5e 41 5f 5d e9 67 bb ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da 4c 89 ee 4c 89 e7 e8 ad 2c 00 00 e9 bd fd ff ff <0f> 0b 89 c8 4c 8d 04 03 40 f6 c6 80 0f 84 41 ff ff ff 83 e6 08 0f [ 286.908347] RSP: 0018:ffffcfce8280bb50 EFLAGS: 00010246 [ 286.908365] RAX: ffff8b2dcef2c800 RBX: ffff8b2dcef2c800 RCX: ffff8b2dcef2c830 [ 286.908389] RDX: 00000000000be001 RSI: 0000000000000000 RDI: ffff8b2dcef2c880 [ 286.908414] RBP: ffffcfce8280bba0 R08: ffff8b2dcef2c860 R09: 0000000000000000 [ 286.908438] R10: ffff8b2dcef2c860 R11: 0000000000000000 R12: ffff8b2dd2841600 [ 286.908462] R13: fffff077003bcb00 R14: ffffffffc093c480 R15: 0000000000000060 [ 286.908487] FS: 00007b10286cd740(0000) GS:ffff8b2e19c6c000(0000) knlGS:0000000000000000 [ 286.908511] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.908532] CR2: 00007fb93027bc70 CR3: 00000000034f0005 CR4: 00000000001706f0 [ 286.908559] Call Trace: [ 286.908570] <TASK> [ 286.908581] ? _raw_spin_unlock_bh+0xe/0x20 [ 286.908599] iwl_pcie_txq_free+0x130/0x170 [iwlwifi] [ 286.908644] iwl_pcie_tx_free+0x66/0xe0 [iwlwifi] [ 286.908681] iwl_trans_pcie_free+0x1df/0x250 [iwlwifi] [ 286.908719] pci_device_remove+0x42/0xb0 [ 286.908736] device_release_driver_internal+0x19c/0x200 [ 286.908755] unbind_store+0xa1/0xb0 [ 286.908771] kernfs_fop_write_iter+0x150/0x200 [ 286.908790] vfs_write+0x25d/0x450 [ 286.908806] ksys_write+0x6b/0xe0 [ 286.908825] do_syscall_64+0x84/0x800 [ 286.908842] ? syscall_exit_work+0x108/0x140 [ 286.908861] ? do_syscall_64+0xbb/0x800 [ 286.908876] ? ksys_dup3+0x63/0xf0 [ 286.908892] ? syscall_exit_work+0x108/0x140 [ 286.911388] ? do_syscall_64+0xbb/0x800 [ 286.911408] ? do_sys_openat2+0xa4/0xe0 [ 286.911423] ? syscall_exit_work+0x108/0x140 [ 286.911443] ? do_syscall_64+0xbb/0x800 [ 286.911458] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 286.911477] RIP: 0033:0x7b102873ec5e [ 286.911493] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa [ 286.911549] RSP: 002b:00007ffd94bc3100 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 286.911575] RAX: ffffffffffffffda RBX: 00007b10288ba5c0 RCX: 00007b102873ec5e [ 286.911600] RDX: 000000000000000d RSI: 00006385db4f8020 RDI: 0000000000000001 [ 286.911625] RBP: 00007ffd94bc3110 R08: 0000000000000000 R09: 0000000000000000 [ 286.911650] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000d [ 286.911674] R13: 000000000000000d R14: 00006385db4f8020 R15: 00006385db4f5b30 [ 286.911701] </TASK> [ 286.911711] Modules linked in: iwldvm iwlwifi mac80211 ehci_pci ehci_hcd
nft_natnft_flow_offloadnf_flow_table_inetnf_flow_tableqrtrnf_conntrack_netlinknft_reject_ipv6nf_reject_ipv6nft_reject_ipv4nf_reject_ipv4nft_rejectnft_ctnft_masqnft_chain_natnf_natnf_conntracknf_defrag_ipv6nf_defrag_ipv4nf_tablesjoydev libarc4intel_rapl_msrintel_rapl_commonpolyval_clmulnighash_clmulni_intelcfg80211 e1000eata_genericrfkilli2c_piix4pata_acpii2c_smbuspcspkr floppy vfat fatserio_rawxen_scsibacktarget_core_modxen_netbackxen_privcmdxen_gntdevxen_gntallocxen_blkbackxen_evtchni2c_devfuse loop nfnetlink overlayxen_blkfront[last unloaded: iwlwifi][ 286.911967] ---[ end trace 0000000000000000 ]---This is running in a VM (HVM) under Xen, with relevant PCI device attached, but I don't think it's relevant for this bug.
Quoted 6 lines
Quoted 3 lines
I've got reports about the issue in Linux 6.18.15 initially (after updating from 6.12), but later tests identified it's a regression somewhere between 6.15.11 and 6.16.8.
Hi, could you please test the attached patch?
It is based on 6.18
Yes, the patch fixes it!
Signature · 3 lines
Best Regards, Marek Marczykowski-Górecki Invisible Things Lab
Korenblit, Miriam Rachel
maintainerQuoted 109 lines
-----Original Message-----
From: Marek Marczykowski-Górecki <[email protected]>
Sent: Thursday, July 16, 2026 1:36 PM
To: Korenblit, Miriam Rachel <[email protected]>
Cc: [email protected]; [email protected]
Subject: Re: kernel BUG atmm/slub.c:634(kfree) when unbinding device from iwlwifiQuoted 90 lines · Miriam Rachel
Quoted 90 lines
-----Original Message-----
From: Marek Marczykowski-Górecki <[email protected]>
Sent: Wednesday, July 15, 2026 5:33 PM
To: Korenblit, Miriam Rachel <[email protected]>
Cc: [email protected]; [email protected]
Subject: kernel BUG atmm/slub.c:634(kfree) when unbinding device from iwlwifiHello,
I get a kernel panic when unbinding device (8086:0085) from the iwlwifi driver (via writing to the "unbind" file in sysfs), while the wifi connection is active. I can reproduce it on Thinkpad X230, but other devices might be affected too. The specific crash is:
[ 286.908182] kernel BUG at mm/slub.c:634! [ 286.908201] Oops: invalid opcode: 0000 [#1] SMP PTI [ 286.908221] CPU: 1 UID: 0 PID: 1959 Comm: prepare-suspend Not tainted 6.18.15-1.qubes.fc41.x86_64 #1 PREEMPT(full) [ 286.908255] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026 [ 286.908275] RIP: 0010:kfree+0x3a8/0x470 [ 286.908292] Code: 5d 41 5e 41 5f 5d e9 67 bb ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da 4c 89 ee 4c 89 e7 e8 ad 2c 00 00 e9 bd fd ff ff <0f> 0b 89 c8 4c 8d 04 03 40 f6 c6 80 0f 84 41 ff ff ff 83 e6 08 0f [ 286.908347] RSP: 0018:ffffcfce8280bb50 EFLAGS: 00010246 [ 286.908365] RAX: ffff8b2dcef2c800 RBX: ffff8b2dcef2c800 RCX: ffff8b2dcef2c830 [ 286.908389] RDX: 00000000000be001 RSI: 0000000000000000 RDI: ffff8b2dcef2c880 [ 286.908414] RBP: ffffcfce8280bba0 R08: ffff8b2dcef2c860 R09: 0000000000000000 [ 286.908438] R10: ffff8b2dcef2c860 R11: 0000000000000000 R12: ffff8b2dd2841600 [ 286.908462] R13: fffff077003bcb00 R14: ffffffffc093c480 R15: 0000000000000060 [ 286.908487] FS: 00007b10286cd740(0000) GS:ffff8b2e19c6c000(0000) knlGS:0000000000000000 [ 286.908511] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.908532] CR2: 00007fb93027bc70 CR3: 00000000034f0005 CR4: 00000000001706f0 [ 286.908559] Call Trace: [ 286.908570] <TASK> [ 286.908581] ? _raw_spin_unlock_bh+0xe/0x20 [ 286.908599] iwl_pcie_txq_free+0x130/0x170 [iwlwifi] [ 286.908644] iwl_pcie_tx_free+0x66/0xe0 [iwlwifi] [ 286.908681] iwl_trans_pcie_free+0x1df/0x250 [iwlwifi] [ 286.908719] pci_device_remove+0x42/0xb0 [ 286.908736] device_release_driver_internal+0x19c/0x200 [ 286.908755] unbind_store+0xa1/0xb0 [ 286.908771] kernfs_fop_write_iter+0x150/0x200 [ 286.908790] vfs_write+0x25d/0x450 [ 286.908806] ksys_write+0x6b/0xe0 [ 286.908825] do_syscall_64+0x84/0x800 [ 286.908842] ? syscall_exit_work+0x108/0x140 [ 286.908861] ? do_syscall_64+0xbb/0x800 [ 286.908876] ? ksys_dup3+0x63/0xf0 [ 286.908892] ? syscall_exit_work+0x108/0x140 [ 286.911388] ? do_syscall_64+0xbb/0x800 [ 286.911408] ? do_sys_openat2+0xa4/0xe0 [ 286.911423] ? syscall_exit_work+0x108/0x140 [ 286.911443] ? do_syscall_64+0xbb/0x800 [ 286.911458] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 286.911477] RIP: 0033:0x7b102873ec5e [ 286.911493] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b93 08 03 00 00
59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2
39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa[ 286.911549] RSP: 002b:00007ffd94bc3100 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 286.911575] RAX: ffffffffffffffda RBX: 00007b10288ba5c0 RCX: 00007b102873ec5e [ 286.911600] RDX: 000000000000000d RSI: 00006385db4f8020 RDI: 0000000000000001 [ 286.911625] RBP: 00007ffd94bc3110 R08: 0000000000000000 R09: 0000000000000000 [ 286.911650] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000d [ 286.911674] R13: 000000000000000d R14: 00006385db4f8020 R15: 00006385db4f5b30 [ 286.911701] </TASK> [ 286.911711] Modules linked in: iwldvm iwlwifi mac80211
ehci_pciehci_hcdnft_natnft_flow_offloadnf_flow_table_inetnf_flow_tableqrtrnf_conntrack_netlinknft_reject_ipv6nf_reject_ipv6nft_reject_ipv4Quoted 8 lines
Quoted 8 lines
nf_reject_ipv4nft_rejectnft_ctnft_masqnft_chain_natnf_natnf_conntracknf_defrag_ipv6nf_defrag_ipv4nf_tablesjoydev libarc4intel_rapl_msrintel_rapl_commonpolyval_clmulnighash_clmulni_intelcfg80211 e1000eata_genericrfkilli2c_piix4pata_acpii2c_smbuspcspkr floppy vfat fatserio_rawxen_scsibacktarget_core_modxen_netbackxen_privcmdxen_gntdevxen_gntallocxen_blkbackxen_evtchni2c_devfuse loop nfnetlink overlayxen_blkfront[last unloaded:
Quoted 14 lines
iwlwifi]
Quoted 11 lines
Quoted 8 lines
[ 286.911967] ---[ end trace 0000000000000000 ]---This is running in a VM (HVM) under Xen, with relevant PCI device attached, but I don't think it's relevant for this bug.
I've got reports about the issue in Linux 6.18.15 initially (after updating from 6.12), but later tests identified it's a regression somewhere between 6.15.11 and 6.16.8.
Hi, could you please test the attached patch?
It is based on 6.18
Yes, the patch fixes it!
Thank you for testing! I'll send a fix.
Quoted 7 lines
--
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab