[BUG] iwlwifi oops in iwl_pcie_rx_handle on resume

[Chris Bainbridge]

Hi,

I just got an oops with v7.0-rc1 shortly after resume:

<6>[ 9761.194306] ACPI: EC: interrupt unblocked
<6>[ 9761.336806] amdgpu 0000:03:00.0: [drm] PCIE GART of 1024M enabled.
<6>[ 9761.336816] amdgpu 0000:03:00.0: [drm] PTB located at 0x000000F41FC00000
<6>[ 9761.337043] amdgpu 0000:03:00.0: SMU is resuming...
<6>[ 9761.338126] amdgpu 0000:03:00.0: dpm has been disabled
<6>[ 9761.338943] amdgpu 0000:03:00.0: SMU is resumed successfully!
<6>[ 9761.439301] [drm] DM_MST: Differing MST start on aconnector: 000000001b6f89b3 [id: 116]
<6>[ 9761.441525] amdgpu 0000:03:00.0: ring gfx uses VM inv eng 0 on hub 0
<6>[ 9761.441530] amdgpu 0000:03:00.0: ring comp_1.0.0 uses VM inv eng 1 on hub 0
<6>[ 9761.441532] amdgpu 0000:03:00.0: ring comp_1.1.0 uses VM inv eng 4 on hub 0
<6>[ 9761.441534] amdgpu 0000:03:00.0: ring comp_1.2.0 uses VM inv eng 5 on hub 0
<6>[ 9761.441536] amdgpu 0000:03:00.0: ring comp_1.3.0 uses VM inv eng 6 on hub 0
Oops#1 Part6
<6>[ 9761.441538] amdgpu 0000:03:00.0: ring comp_1.0.1 uses VM inv eng 7 on hub 0
<6>[ 9761.441540] amdgpu 0000:03:00.0: ring comp_1.1.1 uses VM inv eng 8 on hub 0
<6>[ 9761.441542] amdgpu 0000:03:00.0: ring comp_1.2.1 uses VM inv eng 9 on hub 0
<6>[ 9761.441544] amdgpu 0000:03:00.0: ring comp_1.3.1 uses VM inv eng 10 on hub 0
<6>[ 9761.441546] amdgpu 0000:03:00.0: ring kiq_0.2.1.0 uses VM inv eng 11 on hub 0
<6>[ 9761.441548] amdgpu 0000:03:00.0: ring sdma0 uses VM inv eng 0 on hub 8
<6>[ 9761.441550] amdgpu 0000:03:00.0: ring vcn_dec uses VM inv eng 1 on hub 8
<6>[ 9761.441552] amdgpu 0000:03:00.0: ring vcn_enc0 uses VM inv eng 4 on hub 8
<6>[ 9761.441554] amdgpu 0000:03:00.0: ring vcn_enc1 uses VM inv eng 5 on hub 8
<6>[ 9761.441556] amdgpu 0000:03:00.0: ring jpeg_dec uses VM inv eng 6 on hub 8
<6>[ 9761.568907] usb 1-1.3.2.4: reset high-speed USB device number 12 using xhci_hcd
<6>[ 9761.767481] nvme nvme0: 8/0/0 default/read/poll queues
<6>[ 9761.922505] iwlwifi 0000:01:00.0: WFPM_UMAC_PD_NOTIFICATION: 0x20
<6>[ 9761.922592] iwlwifi 0000:01:00.0: WFPM_LMAC2_PD_NOTIFICATION: 0x1f
<6>[ 9761.922715] iwlwifi 0000:01:00.0: WFPM_AUTH_KEY_0: 0x90
<6>[ 9761.922787] iwlwifi 0000:01:00.0: CNVI_SCU_SEQ_DATA_DW9: 0x0
<6>[ 9762.052938] OOM killer enabled.
<6>[ 9762.052942] Restarting tasks: Starting
<6>[ 9762.054800] Restarting tasks: Done
<6>[ 9762.054976] efivarfs: resyncing variable state
<6>[ 9762.066314] efivarfs: finished resyncing variable state
<5>[ 9762.066477] random: crng reseeded on system resumption
<6>[ 9762.160714] PM: suspend exit
<6>[ 9762.739294] iwlwifi 0000:01:00.0: WFPM_UMAC_PD_NOTIFICATION: 0x20
Oops#1 Part5
<6>[ 9762.739367] iwlwifi 0000:01:00.0: WFPM_LMAC2_PD_NOTIFICATION: 0x1f
<6>[ 9762.739435] iwlwifi 0000:01:00.0: WFPM_AUTH_KEY_0: 0x90
<6>[ 9762.739451] iwlwifi 0000:01:00.0: CNVI_SCU_SEQ_DATA_DW9: 0x0
<6>[ 9766.455338] wlp1s0: authenticate with d6:92:5e:eb:ee:15 (local address=c8:15:4e:63:1d:e8)
<6>[ 9766.456638] wlp1s0: send auth to d6:92:5e:eb:ee:15 (try 1/3)
<6>[ 9766.518885] wlp1s0: authenticate with d6:92:5e:eb:ee:15 (local address=c8:15:4e:63:1d:e8)
<6>[ 9766.518900] wlp1s0: send auth to d6:92:5e:eb:ee:15 (try 1/3)
<6>[ 9766.522553] wlp1s0: authenticated
<6>[ 9766.524038] wlp1s0: associate with d6:92:5e:eb:ee:15 (try 1/3)
<6>[ 9766.532772] wlp1s0: RX AssocResp from d6:92:5e:eb:ee:15 (capab=0x1011 status=0 aid=21)
<6>[ 9766.549780] wlp1s0: associated
<7>[ 9766.618488] wlp1s0: Limiting TX power to 23 (23 - 0) dBm as advertised by d6:92:5e:eb:ee:15
<4>[ 9809.544787] Oops: general protection fault, probably for non-canonical address 0xe0000d1060000000: 0000 [#1] SMP KASAN
<1>[ 9809.544818] KASAN: maybe wild-memory-access in range [0x0000888300000000-0x0000888300000007]
<4>[ 9809.544825] CPU: 3 UID: 0 PID: 996 Comm: irq/75-iwlwifi: Not tainted 7.0.0-rc1 #444 PREEMPT(lazy)
<4>[ 9809.544832] Hardware name: HP HP Pavilion Aero Laptop 13-be0xxx/8916, BIOS F.17 12/18/2024
<4>[ 9809.544835] RIP: 0010:detach_if_pending (./include/linux/list.h:992 (discriminator 2) kernel/time/timer.c:891 (discriminator 2) kernel/time/timer.c:910 (discriminator 2))
<4>[ 9809.544845] Code: df 4c 89 ea 48 8b 2b 48 c1 ea 03 80 3c 02 00 0f 85 40 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 14 02 00 00 49 89 6d 00 48 85 ed 74 23 48 b8 00
All code
========
   0:	df 4c 89 ea          	fisttps -0x16(%rcx,%rcx,4)
   4:	48 8b 2b             	mov    (%rbx),%rbp
   7:	48 c1 ea 03          	shr    $0x3,%rdx
   b:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   f:	0f 85 40 02 00 00    	jne    0x255
  15:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1c:	fc ff df 
  1f:	4c 8b 6b 08          	mov    0x8(%rbx),%r13
  23:	4c 89 ea             	mov    %r13,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
  2a:*	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)		<-- trapping instruction
  2e:	0f 85 14 02 00 00    	jne    0x248
  34:	49 89 6d 00          	mov    %rbp,0x0(%r13)
  38:	48 85 ed             	test   %rbp,%rbp
  3b:	74 23                	je     0x60
  3d:	48                   	rex.W
  3e:	b8                   	.byte 0xb8
	...

Code starting with the faulting instruction
===========================================
   0:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   4:	0f 85 14 02 00 00    	jne    0x21e
   a:	49 89 6d 00          	mov    %rbp,0x0(%r13)
   e:	48 85 ed             	test   %rbp,%rbp
  11:	74 23                	je     0x36
  13:	48                   	rex.W
  14:	b8                   	.byte 0xb8
	...
<4>[ 9809.544849] RSP: 0018:ffffc90000708850 EFLAGS: 00010016
Oops#1 Part4
<4>[ 9809.544855] RAX: dffffc0000000000 RBX: ffff888107e710e0 RCX: ffffffff86373dde
<4>[ 9809.544859] RDX: 0000111060000000 RSI: ffffffff888b8ec0 RDI: ffffffff88f25138
<4>[ 9809.544862] RBP: dead000000000122 R08: 0000000000000000 R09: fffffbfff139f90c
<4>[ 9809.544865] R10: ffffffff89cfc867 R11: 0000000000000001 R12: 0000000000000000
<4>[ 9809.544868] R13: 0000888300000000 R14: ffff888107e710e8 R15: ffff88838d6af9c0
<4>[ 9809.544872] FS:  0000000000000000(0000) GS:ffff888403005000(0000) knlGS:0000000000000000
<4>[ 9809.544875] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[ 9809.544878] CR2: 00007fad9435741c CR3: 0000000076a91000 CR4: 0000000000750ef0
<4>[ 9809.544882] PKRU: 55555554
<4>[ 9809.544885] Call Trace:
<4>[ 9809.544888]  <IRQ>
<4>[ 9809.544893]  __mod_timer (kernel/time/timer.c:1097)
<4>[ 9809.544899]  ? __get_next_timer_interrupt (kernel/time/timer.c:1019)
<4>[ 9809.544904]  ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/paravirt.h:529 ./arch/x86/include/asm/irqflags.h:159 ./include/linux/spinlock_api_smp.h:178 kernel/locking/spinlock.c:194)
<4>[ 9809.544909]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472 (discriminator 4))
<4>[ 9809.544914]  ? iommu_dma_free_iova (drivers/iommu/dma-iommu.c:245 drivers/iommu/dma-iommu.c:804)
<4>[ 9809.544921]  __iommu_dma_unmap (drivers/iommu/dma-iommu.c:814)
<4>[ 9809.544927]  ? iommu_get_msi_cookie (drivers/iommu/dma-iommu.c:814)
<4>[ 9809.544932]  ? __lock_acquire (kernel/locking/lockdep.c:4674 (discriminator 1) kernel/locking/lockdep.c:5191 (discriminator 1))
<4>[ 9809.544941]  iommu_dma_unmap_phys (./include/linux/swiotlb.h:145 ./include/linux/swiotlb.h:252 drivers/iommu/dma-iommu.c:1250 drivers/iommu/dma-iommu.c:1231)
<4>[ 9809.544947]  ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:107 (discriminator 1) ./include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 1) ./include/linux/atomic/atomic-instrumented.h:1302 (discriminator 1) ./include/asm-generic/qspinlock.h:111 (discriminator 1) kernel/locking/spinlock_debug.c:116 (discriminator 1))
<4>[ 9809.544952]  dma_unmap_phys (kernel/dma/mapping.c:212)
<4>[ 9809.544960] iwl_pcie_rx_handle (drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1311 drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1565) iwlwifi
<4>[ 9809.544980]  ? kasan_save_stack (mm/kasan/common.c:59)
<4>[ 9809.544985]  ? kasan_save_stack (mm/kasan/common.c:58)
<4>[ 9809.544990]  ? __kasan_slab_free (mm/kasan/common.c:287)
<4>[ 9809.544994]  ? kmem_cache_free (mm/slub.c:6124 (discriminator 3) mm/slub.c:6254 (discriminator 3))
<4>[ 9809.544999]  ? handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
<4>[ 9809.545003]  ? __irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723)
Oops#1 Part3
<4>[ 9809.545007]  ? irq_exit_rcu (kernel/softirq.c:741)
<4>[ 9809.545012]  ? cpu_startup_entry (kernel/sched/idle.c:429)
<4>[ 9809.545017]  ? start_secondary (arch/x86/kernel/smpboot.c:200 (discriminator 10) arch/x86/kernel/smpboot.c:280 (discriminator 10))
<4>[ 9809.545025]  ? iwl_pcie_rxq_alloc_rbs (drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1499) iwlwifi
<4>[ 9809.545043] iwl_pcie_napi_poll_msix (drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1042) iwlwifi
<4>[ 9809.545058]  __napi_poll.constprop.0 (net/core/dev.c:7684)
<4>[ 9809.545065]  net_rx_action (net/core/dev.c:7749 net/core/dev.c:7899)
<4>[ 9809.545072]  ? run_backlog_napi (net/core/dev.c:7861)
<4>[ 9809.545079]  ? rcu_momentary_eqs (kernel/rcu/tree.c:2541)
<4>[ 9809.545086]  ? mark_held_locks (kernel/locking/lockdep.c:4325 (discriminator 1))
<4>[ 9809.545091]  ? handle_softirqs (./arch/x86/include/asm/paravirt.h:529 kernel/softirq.c:606)
<4>[ 9809.545096]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
<4>[ 9809.545103]  ? tasklet_unlock_wait (kernel/softirq.c:580)
<4>[ 9809.545108]  ? tasklet_unlock_wait (kernel/softirq.c:580)
<4>[ 9809.545112]  ? tick_nohz_stop_idle (./include/linux/seqlock.h:453 ./include/linux/seqlock.h:525 kernel/time/tick-sched.c:771)
<4>[ 9809.545119]  ? iwl_pcie_irq_rx_msix_handler (./include/linux/bottom_half.h:33 (discriminator 1) drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1666 (discriminator 1)) iwlwifi
<4>[ 9809.545134]  ? iwl_pcie_irq_rx_msix_handler (drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1660 (discriminator 1)) iwlwifi
<4>[ 9809.545148]  do_softirq.part.0 (kernel/softirq.c:523 (discriminator 20))
<4>[ 9809.545153]  </IRQ>
<4>[ 9809.545156]  <TASK>
<4>[ 9809.545158]  __local_bh_enable_ip (kernel/softirq.c:515 (discriminator 1) kernel/softirq.c:450 (discriminator 1))
<4>[ 9809.545163]  ? iwl_pcie_irq_rx_msix_handler (./include/linux/bottom_half.h:33 (discriminator 1) drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1666 (discriminator 1)) iwlwifi
<4>[ 9809.545177] iwl_pcie_irq_rx_msix_handler (drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1668 (discriminator 1)) iwlwifi
<4>[ 9809.545192]  ? iwl_pcie_rx_free (drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1640) iwlwifi
<4>[ 9809.545206]  ? irq_thread (kernel/irq/manage.c:1058 (discriminator 3) kernel/irq/manage.c:1268 (discriminator 3))
<4>[ 9809.545211]  irq_thread_fn (kernel/irq/manage.c:1143)
<4>[ 9809.545216]  irq_thread (kernel/irq/manage.c:1272)
<4>[ 9809.545220]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
<4>[ 9809.545225]  ? __kthread_parkme (./include/linux/instrumented.h:82 ./include/asm-generic/bitops/instrumented-non-atomic.h:141 kernel/kthread.c:290)
<4>[ 9809.545230]  ? irq_copy_pending.isra.0 (kernel/irq/manage.c:1142)
<4>[ 9809.545235]  ? irq_forced_thread_fn (kernel/irq/manage.c:1245)
<4>[ 9809.545239]  ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/paravirt.h:529 ./arch/x86/include/asm/irqflags.h:159 ./include/linux/spinlock_api_smp.h:178 kernel/locking/spinlock.c:194)
Oops#1 Part2
<4>[ 9809.545243]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472 (discriminator 4))
<4>[ 9809.545247]  ? irq_has_action (kernel/irq/manage.c:1179)
<4>[ 9809.545252]  ? __kthread_parkme (./arch/x86/include/asm/bitops.h:202 ./arch/x86/include/asm/bitops.h:232 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/kthread.c:290)
<4>[ 9809.545263]  ? irq_forced_thread_fn (kernel/irq/manage.c:1245)
<4>[ 9809.545270]  kthread (kernel/kthread.c:467)
<4>[ 9809.545277]  ? _raw_spin_unlock_irq (./arch/x86/include/asm/paravirt.h:529 ./include/linux/spinlock_api_smp.h:187 kernel/locking/spinlock.c:202)
<4>[ 9809.545284]  ? kthread_affine_node (kernel/kthread.c:412)
<4>[ 9809.545292]  ret_from_fork (arch/x86/kernel/process.c:164)
<4>[ 9809.545302]  ? exit_thread (arch/x86/kernel/process.c:153)
<4>[ 9809.545312]  ? __switch_to (./arch/x86/include/asm/cpufeature.h:101 arch/x86/kernel/process_64.c:377 arch/x86/kernel/process_64.c:665)
<4>[ 9809.545320]  ? kthread_affine_node (kernel/kthread.c:412)
<4>[ 9809.545330]  ret_from_fork_asm (arch/x86/entry/entry_64.S:255)
<4>[ 9809.545351]  </TASK>
<4>[ 9809.545357] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat x_tables nf_tables br_netfilter bridge stp llc ccm overlay qrtr rfcomm cmac algif_hash algif_skcipher af_alg bnep binfmt_misc ext4 mbcache jbd2 nls_ascii nls_cp437 vfat fat snd_acp3x_rn snd_acp3x_pdm_dma snd_soc_dmic intel_rapl_msr snd_soc_core snd_compress snd_hda_codec_generic amd_atl intel_rapl_common iwlmvm uvcvideo videobuf2_vmalloc btusb mac80211 snd_usb_audio snd_hda_codec_hdmi videobuf2_memops kvm_amd libarc4 btrtl uvc snd_usbmidi_lib snd_pci_acp6x btintel videobuf2_v4l2 snd_rawmidi btbcm videodev kvm snd_seq_device btmtk snd_hda_intel irqbypass snd_pci_acp5x videobuf2_common snd_hda_codec bluetooth snd_intel_dspcfg rapl mc snd_hwdep ecdh_generic ecc wmi_bmof snd_hda_core snd_rn_pci_acp3x iwlwifi snd_pcm snd_acp_config pcspkr ee1004 k10temp snd_soc_acpi snd_timer ac cfg80211 battery snd
Oops#1 Part1
<4>[ 9809.545588]  snd_pci_acp3x rfkill soundcore ccp joydev button amd_pmc sg acpi_tad evdev msr parport_pc ppdev lp parport efi_pstore nvme_fabrics fuse configfs nfnetlink efivarfs autofs4 btrfs xor libblake2b raid6_pq dm_crypt dm_mod r8153_ecm cdc_ether usbnet sd_mod hid_microsoft ff_memless hid_cmedia uas r8152 usb_storage mii scsi_mod libphy mdio_bus usbhid scsi_common amdgpu drm_client_lib i2c_algo_bit drm_ttm_helper ttm drm_exec drm_suballoc_helper drm_buddy drm_panel_backlight_quirks gpu_sched amdxcp hid_multitouch drm_display_helper sp5100_tco ucsi_acpi hid_generic drm_kms_helper xhci_pci watchdog video typec_ucsi cec i2c_hid_acpi roles i2c_piix4 xhci_hcd ghash_clmulni_intel nvme rc_core serio_raw i2c_hid amd_sfh typec i2c_smbus usbcore crc16 nvme_core hid thunderbolt fan usb_common wmi drm aesni_intel
<4>[ 9809.545854] ---[ end trace 0000000000000000 ]---
<4>[ 9809.764012] RIP: 0010:detach_if_pending (./include/linux/list.h:992 (discriminator 2) kernel/time/timer.c:891 (discriminator 2) kernel/time/timer.c:910 (discriminator 2))
<4>[ 9809.764021] Code: df 4c 89 ea 48 8b 2b 48 c1 ea 03 80 3c 02 00 0f 85 40 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 14 02 00 00 49 89 6d 00 48 85 ed 74 23 48 b8 00
All code
========
   0:	df 4c 89 ea          	fisttps -0x16(%rcx,%rcx,4)
   4:	48 8b 2b             	mov    (%rbx),%rbp
   7:	48 c1 ea 03          	shr    $0x3,%rdx
   b:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   f:	0f 85 40 02 00 00    	jne    0x255
  15:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1c:	fc ff df 
  1f:	4c 8b 6b 08          	mov    0x8(%rbx),%r13
  23:	4c 89 ea             	mov    %r13,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
  2a:*	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)		<-- trapping instruction
  2e:	0f 85 14 02 00 00    	jne    0x248
  34:	49 89 6d 00          	mov    %rbp,0x0(%r13)
  38:	48 85 ed             	test   %rbp,%rbp
  3b:	74 23                	je     0x60
  3d:	48                   	rex.W
  3e:	b8                   	.byte 0xb8
	...

Code starting with the faulting instruction
===========================================
   0:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   4:	0f 85 14 02 00 00    	jne    0x21e
   a:	49 89 6d 00          	mov    %rbp,0x0(%r13)
   e:	48 85 ed             	test   %rbp,%rbp
  11:	74 23                	je     0x36
  13:	48                   	rex.W
  14:	b8                   	.byte 0xb8
	...
<4>[ 9809.764025] RSP: 0018:ffffc90000708850 EFLAGS: 00010016
<4>[ 9809.764031] RAX: dffffc0000000000 RBX: ffff888107e710e0 RCX: ffffffff86373dde
<4>[ 9809.764033] RDX: 0000111060000000 RSI: ffffffff888b8ec0 RDI: ffffffff88f25138
<4>[ 9809.764036] RBP: dead000000000122 R08: 0000000000000000 R09: fffffbfff139f90c
<4>[ 9809.764038] R10: ffffffff89cfc867 R11: 0000000000000001 R12: 0000000000000000
<4>[ 9809.764040] R13: 0000888300000000 R14: ffff888107e710e8 R15: ffff88838d6af9c0
<4>[ 9809.764043] FS:  0000000000000000(0000) GS:ffff888403005000(0000) knlGS:0000000000000000
<4>[ 9809.764046] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[ 9809.764048] CR2: 00007fad9435741c CR3: 0000000076a91000 CR4: 0000000000750ef0
<4>[ 9809.764051] PKRU: 55555554
<0>[ 9809.764054] Kernel panic - not syncing: Fatal exception in interrupt
<0>[ 9811.126715] Shutting down cpus with NMI
<0>[ 9811.126752] Kernel Offset: 0x4c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)


This could possibly be related to a similar oops I saw last week, in
that case the stack trace didn't point to iwlwifi, but the oops appeared
to be the result of memory corruption:
https://lkml.org/lkml/2026/2/18/486