Public bug reported:
# mac80211: repeated crashes in ieee80211_del_chanctx during hw-restart
teardown after a failed CSA
**Product:** Drivers
**Component:** network-wireless-intel
**Kernel:** 7.0.0-29-generic (Ubuntu 26.04 LTS)
**Regression:** unknown — no known-good kernel identified
## Summary
A channel-switch announcement from the AP drives the iwldvm firmware into an
error, mac80211 requests a hardware restart, and the resulting teardown path
crashes. It has crashed this machine **8 times in 8 days**, always with the same
faulting instruction:
```
RIP: 0010:ieee80211_del_chanctx+0x161/0x170 [mac80211]
```
The final fault varies (NULL pointer dereference, page fault, `kernel BUG at
mm/slub.c:542`) but the faulting site does not. The BUG variant lands in
`build_detached_freelist`, i.e. slab freelist corruption, which suggests the
earlier faults are the same object being freed twice or freed while still
referenced.
The crash site is generic mac80211, not the Intel driver. iwlwifi only supplies
the trigger (a firmware error during `REPLY_CHANNEL_SWITCH`). Any driver that
reports a hardware restart while a channel context is live looks like it would
reach the same path, so this may not be limited to the old hardware reporting
it.
## Hardware / firmware
```
03:00.0 Network controller [0280]: Intel Corporation Centrino Ultimate-N 6300
[8086:4238] (rev 3e)
Subsystem: Intel Corporation Centrino Ultimate-N 6300 3x3 AGN
[8086:1111]
driver: iwlwifi (op_mode iwldvm)
firmware-version: 9.221.4.1 build 25532 6000-4.ucode
Hardware name: LENOVO 4284AT3/4284AT3, BIOS 8BET66WW (1.46) 06/14/2018
```
## Trigger sequence
The machine is a wired server; wifi is an idle standby link associated to a
consumer AP. No user action is involved — the AP emits a channel-switch
announcement on its own.
```
1. AP beacon carries a CSA
ieee80211_rx_mgmt_beacon
ieee80211_sta_process_chanswitch
drv_channel_switch [mac80211]
iwlagn_mac_channel_switch [iwldvm]
iwl6000_hw_channel_switch
iwl_dvm_send_cmd
2. iwlwifi 0000:03:00.0: FW error in SYNC CMD REPLY_CHANNEL_SWITCH
iwlwifi 0000:03:00.0: Device error - SW reset
wlp3s0: driver channel switch failed (link 0), disconnecting
ieee80211 phy0: Hardware restart was requested
3. CSA drop work runs while the firmware is already down:
ieee80211_csa_connection_drop_work
__ieee80211_disconnect
ieee80211_set_disassoc
ieee80211_flush_queues -> drv_flush -> iwlagn_mac_flush
WARNING: drivers/net/wireless/intel/iwlwifi/iwl-trans.c:714
at iwl_trans_wait_tx_queues_empty ("bad state = 0")
iwlwifi: Fw not loaded - dropping CMD: 18 / 1e
iwlwifi: Couldn't flush the AGG queue
iwlwifi: Microcode SW error detected. Restarting 0x82000000.
0x00000005 | SYSASSERT
4. Restart/reprobe teardown:
WARNING: net/mac80211/driver-ops.c:41 at drv_stop+0x144/0x160 [mac80211]
WARNING: net/mac80211/driver-ops.h:1038 at ieee80211_del_chanctx+0x161/0x170
[mac80211]
ieee80211_free_chanctx
__ieee80211_link_release_channel
ieee80211_link_stop
ieee80211_teardown_sdata
ieee80211_uninit
unregister_netdevice_many_notify
_cfg80211_unregister_wdev
ieee80211_remove_interfaces
ieee80211_unregister_hw
iwlagn_mac_unregister [iwldvm]
iwl_op_mode_dvm_stop [iwldvm]
iwl_drv_stop [iwlwifi]
iwl_pcie_gen1_2_remove [iwlwifi]
iwl_pci_remove [iwlwifi]
pci_device_remove
Workqueue: events iwl_trans_reprobe_wk [iwlwifi]
5. kernel BUG at mm/slub.c:542!
RIP: 0010:build_detached_freelist+0x1ea/0x220
```
The three WARNINGs in steps 3-4 all say the same thing: state is being torn down
that the driver already considers stopped. `driver-ops.c:41` is the `drv_stop`
started-check; `driver-ops.h:1038` is the `del_chanctx` check. Execution
continues past both, and the object is freed anyway.
## Crash history
Every crash left a pstore record. Faulting site is identical throughout; only
the
symptom differs.
| Date (local) | Preceded by CSA FW error | Recorded fault |
|---|---|---|
| Aug 05 09:25 | yes (09:06) | `BUG: unable to handle page fault for address:
0000020000000040`, `drv_stop`, `ieee80211_del_chanctx` |
| Aug 06 07:08 | no | `kernel BUG at mm/usercopy.c:102` |
| Aug 07 05:07 | yes (05:07) | `BUG: kernel NULL pointer dereference`,
`ieee80211_del_chanctx` |
| Aug 09 08:18 | yes (08:17) | `BUG: kernel NULL pointer dereference`,
`drv_stop`, `ieee80211_del_chanctx`, `ieee80211_reconfig` |
| Aug 11 18:53 | no | `BUG: kernel NULL pointer dereference` |
| Aug 12 08:54 | yes (08:54) | `kernel BUG at mm/slub.c:542`, `drv_stop`,
`ieee80211_del_chanctx`, `ieee80211_reconfig` |
All four `REPLY_CHANNEL_SWITCH` firmware errors in the retained journal ended in
a crash within 1-19 minutes. There is no instance of the machine surviving one.
## Reproduction
Not reproducible on demand — it depends on the AP electing to change channel.
Observed roughly every 1-2 days with an AP that changes channel on its own
(consumer AP, auto-channel selection). Forcing a CSA from a controllable AP
while
an iwldvm client is associated should reproduce it.
## Notes
- `linux-firmware` is current (20260319.git217ca6e4). The two
`Direct firmware load for iwlwifi-6000-{6,5}.ucode failed with error -2` lines
at probe are the normal descending API-version walk; `6000-4.ucode` loads.
- Taint is `[I]=FIRMWARE_WORKAROUND` only — no out-of-tree modules.
- Machine is otherwise stable; it is a headless wired server and the wifi link
carries no traffic.
- The AP's BSSID is locally administered (first octet `0x4a`), i.e. a virtual /
multi-SSID BSSID, so it carries no vendor OUI. Logs are attached unredacted.
## Attachments
- `dmesg-crash-boot.log` — full kernel log for the boot that ended in the slub
BUG
- `pstore-all-crashes.log` — the kernel's own pstore records for all crashes
above
- `apport-linux.apport` — standard Ubuntu apport collection (lspci, lsusb -v,
dpkg list, cpuinfo, etc.) with the crash-boot dmesg and pstore dumps embedded
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 iwlwifi kernel-bug mac80211 stonking
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2163438
Title:
mac80211: repeated crashes in ieee80211_del_chanctx during hw-restart
teardown after a failed CSA (iwldvm / Centrino 6300 AGN)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2163438/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
