RE: kernel BUG at mm/slub.c:634 (kfree) when unbinding device from iwlwifi

["Korenblit, Miriam Rachel" <miriam.rachel.korenblit@intel.com>]

> -----Original Message-----
> From: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
> Sent: Thursday, July 16, 2026 1:36 PM
> To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com>
> Cc: linux-wireless@vger.kernel.org; linux-kernel@vger.kernel.org
> Subject: Re: kernel BUG at mm/slub.c:634 (kfree) when unbinding device from
> iwlwifi
> 
> On Wed, Jul 15, 2026 at 05:22:44PM +0000, Korenblit, Miriam Rachel wrote:
> >
> >
> > > -----Original Message-----
> > > From: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
> > > Sent: Wednesday, July 15, 2026 5:33 PM
> > > To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com>
> > > Cc: linux-wireless@vger.kernel.org; linux-kernel@vger.kernel.org
> > > Subject: kernel BUG at mm/slub.c:634 (kfree) when unbinding device
> > > from iwlwifi
> > >
> > > Hello,
> > >
> > > I get a kernel panic when unbinding device (8086:0085) from the
> > > iwlwifi driver (via writing to the "unbind" file in sysfs), while
> > > the wifi connection is active. I can reproduce it on Thinkpad X230,
> > > but other devices might be affected too. The specific crash is:
> > >
> > >     [  286.908182] kernel BUG at mm/slub.c:634!
> > >     [  286.908201] Oops: invalid opcode: 0000 [#1] SMP PTI
> > >     [  286.908221] CPU: 1 UID: 0 PID: 1959 Comm: prepare-suspend Not
> > > tainted
> > > 6.18.15-1.qubes.fc41.x86_64 #1 PREEMPT(full)
> > >     [  286.908255] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026
> > >     [  286.908275] RIP: 0010:kfree+0x3a8/0x470
> > >     [  286.908292] Code: 5d 41 5e 41 5f 5d e9 67 bb ff ff 4d 89 f1
> > > 41 b8 01 00 00 00
> > > 48 89 d9 48 89 da 4c 89 ee 4c 89 e7 e8 ad 2c 00 00 e9 bd fd ff ff
> > > <0f> 0b 89 c8 4c 8d 04 03 40 f6 c6 80 0f 84 41 ff ff ff 83 e6 08 0f
> > >     [  286.908347] RSP: 0018:ffffcfce8280bb50 EFLAGS: 00010246
> > >     [  286.908365] RAX: ffff8b2dcef2c800 RBX: ffff8b2dcef2c800 RCX:
> > > ffff8b2dcef2c830
> > >     [  286.908389] RDX: 00000000000be001 RSI: 0000000000000000 RDI:
> > > ffff8b2dcef2c880
> > >     [  286.908414] RBP: ffffcfce8280bba0 R08: ffff8b2dcef2c860 R09:
> > > 0000000000000000
> > >     [  286.908438] R10: ffff8b2dcef2c860 R11: 0000000000000000 R12:
> > > ffff8b2dd2841600
> > >     [  286.908462] R13: fffff077003bcb00 R14: ffffffffc093c480 R15:
> > > 0000000000000060
> > >     [  286.908487] FS:  00007b10286cd740(0000)
> > > GS:ffff8b2e19c6c000(0000)
> > > knlGS:0000000000000000
> > >     [  286.908511] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > >     [  286.908532] CR2: 00007fb93027bc70 CR3: 00000000034f0005 CR4:
> > > 00000000001706f0
> > >     [  286.908559] Call Trace:
> > >     [  286.908570]  <TASK>
> > >     [  286.908581]  ? _raw_spin_unlock_bh+0xe/0x20
> > >     [  286.908599]  iwl_pcie_txq_free+0x130/0x170 [iwlwifi]
> > >     [  286.908644]  iwl_pcie_tx_free+0x66/0xe0 [iwlwifi]
> > >     [  286.908681]  iwl_trans_pcie_free+0x1df/0x250 [iwlwifi]
> > >     [  286.908719]  pci_device_remove+0x42/0xb0
> > >     [  286.908736]  device_release_driver_internal+0x19c/0x200
> > >     [  286.908755]  unbind_store+0xa1/0xb0
> > >     [  286.908771]  kernfs_fop_write_iter+0x150/0x200
> > >     [  286.908790]  vfs_write+0x25d/0x450
> > >     [  286.908806]  ksys_write+0x6b/0xe0
> > >     [  286.908825]  do_syscall_64+0x84/0x800
> > >     [  286.908842]  ? syscall_exit_work+0x108/0x140
> > >     [  286.908861]  ? do_syscall_64+0xbb/0x800
> > >     [  286.908876]  ? ksys_dup3+0x63/0xf0
> > >     [  286.908892]  ? syscall_exit_work+0x108/0x140
> > >     [  286.911388]  ? do_syscall_64+0xbb/0x800
> > >     [  286.911408]  ? do_sys_openat2+0xa4/0xe0
> > >     [  286.911423]  ? syscall_exit_work+0x108/0x140
> > >     [  286.911443]  ? do_syscall_64+0xbb/0x800
> > >     [  286.911458]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> > >     [  286.911477] RIP: 0033:0x7b102873ec5e
> > >     [  286.911493] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b
> > > 93 08 03 00 00
> > > 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05
> > > <c9> c3 83 e2
> > > 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa
> > >     [  286.911549] RSP: 002b:00007ffd94bc3100 EFLAGS: 00000202 ORIG_RAX:
> > > 0000000000000001
> > >     [  286.911575] RAX: ffffffffffffffda RBX: 00007b10288ba5c0 RCX:
> > > 00007b102873ec5e
> > >     [  286.911600] RDX: 000000000000000d RSI: 00006385db4f8020 RDI:
> > > 0000000000000001
> > >     [  286.911625] RBP: 00007ffd94bc3110 R08: 0000000000000000 R09:
> > > 0000000000000000
> > >     [  286.911650] R10: 0000000000000000 R11: 0000000000000202 R12:
> > > 000000000000000d
> > >     [  286.911674] R13: 000000000000000d R14: 00006385db4f8020 R15:
> > > 00006385db4f5b30
> > >     [  286.911701]  </TASK>
> > >     [  286.911711] Modules linked in: iwldvm iwlwifi mac80211
> > > ehci_pci ehci_hcd nft_nat nft_flow_offload nf_flow_table_inet
> > > nf_flow_table qrtr nf_conntrack_netlink nft_reject_ipv6
> > > nf_reject_ipv6 nft_reject_ipv4
> > > nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat
> > > nf_conntrack
> > > nf_defrag_ipv6 nf_defrag_ipv4 nf_tables joydev libarc4
> > > intel_rapl_msr intel_rapl_common polyval_clmulni ghash_clmulni_intel
> > > cfg80211 e1000e ata_generic rfkill i2c_piix4 pata_acpi i2c_smbus
> > > pcspkr floppy vfat fat serio_raw xen_scsiback target_core_mod
> > > xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback
> > > xen_evtchn i2c_dev fuse loop nfnetlink overlay xen_blkfront [last unloaded:
> iwlwifi]
> > >     [  286.911967] ---[ end trace 0000000000000000 ]---
> > >
> > > This is running in a VM (HVM) under Xen, with relevant PCI device
> > > attached, but I don't think it's relevant for this bug.
> > >
> > > I've got reports about the issue in Linux 6.18.15 initially (after
> > > updating from 6.12), but later tests identified it's a regression
> > > somewhere between 6.15.11 and 6.16.8.
> >
> > Hi, could you please test the attached patch?
> > It is based on 6.18
> 
> 
Yes, the patch fixes it!

Thank you for testing! I'll send a fix.
> 
> Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
> 
> --
> Best Regards,
> Marek Marczykowski-Górecki
> Invisible Things Lab