Backtrace

WARNING: CPU: 3 PID: 518 at drivers/net/wireless/intel/iwlwifi/mvm/sta.c:2990 iwl_mvm_sta_rx_agg+0x9a5/0xb30 [iwlmvm]
Modules linked in: overlay uinput rfcomm snd_seq_dummy snd_hrtimer uhid nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set sunrpc nf_tables qrtr bnep snd_soc_skl_hda_dsp snd_soc_intel_sof_board_helpers snd_soc_intel_hda_dsp_common snd_sof_probes binfmt_misc elan_i2c vfat fat snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_soc_dmic snd_sof_pci_intel_tgl snd_sof_pci_intel_cnl snd_sof_intel_hda_generic soundwire_intel snd_sof_intel_hda_sdw_bpt snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda snd_hda_codec_hdmi soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp iwlmvm snd_sof snd_sof_utils snd_soc_acpi_intel_match intel_uncore_frequency snd_soc_acpi_intel_sdca_quirks intel_uncore_frequency_common soundwire_generic_allocation intel_tcc_cooling snd_soc_acpi x86_pkg_temp_thermal
 crc8 mac80211 soundwire_bus intel_powerclamp snd_soc_sdca coretemp mei_pxp ee1004 iTCO_wdt snd_soc_avs mei_hdcp snd_soc_hda_codec intel_pmc_bxt kvm_intel libarc4 spi_nor iTCO_vendor_support snd_hda_ext_core mtd intel_rapl_msr snd_soc_core kvm snd_compress ac97_bus snd_pcm_dmaengine snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi uvcvideo irqbypass btusb btrtl uvc snd_hda_codec videobuf2_vmalloc rapl btintel videobuf2_memops iwlwifi btbcm videobuf2_v4l2 intel_cstate snd_hda_core btmtk videobuf2_common snd_hwdep processor_thermal_device_pci_legacy think_lmi pcspkr processor_thermal_device intel_uncore snd_seq snd_ctl_led videodev snd_seq_device bluetooth processor_thermal_wt_hint firmware_attributes_class cfg80211 wmi_bmof snd_pcm thinkpad_acpi platform_temperature_control mc r8169 mei_me processor_thermal_rfim processor_thermal_rapl snd_timer intel_rapl_common mei spi_intel_pci i2c_i801 sparse_keymap idma64 i2c_smbus spi_intel realtek platform_profile processor_thermal_wt_req
 processor_thermal_power_floor rfkill processor_thermal_mbox snd igen6_edac intel_soc_dts_iosf soundcore int3403_thermal int340x_thermal_zone intel_pmc_core pmt_telemetry pmt_class acpi_pad int3400_thermal intel_pmc_ssram_telemetry acpi_thermal_rel acpi_tad joydev loop nfnetlink zram lz4hc_compress lz4_compress xe drm_ttm_helper drm_suballoc_helper gpu_sched drm_gpuvm drm_exec drm_gpusvm ucsi_acpi typec_ucsi typec i915 nvme i2c_algo_bit polyval_clmulni ghash_clmulni_intel drm_buddy sha512_ssse3 nvme_core ttm drm_display_helper sha1_ssse3 nvme_keyring nvme_auth cec thunderbolt intel_vsec video intel_oc_wdt wmi pinctrl_tigerlake serio_raw fuse i2c_dev
CPU: 3 UID: 0 PID: 518 Comm: kworker/u32:6 Tainted: G        W           6.16.4-100.fc41.x86_64 #1 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: LENOVO 20TES1XH00/20TES1XH00, BIOS R1EET56W(1.56 ) 06/29/2023
Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]
RIP: 0010:iwl_mvm_sta_rx_agg+0x9a5/0xb30 [iwlmvm]
Code: e9 21 fd ff ff 79 cb 31 db e9 93 fa ff ff 0f 89 0d fd ff ff e9 88 fa ff ff 0f 0b 41 b9 ea ff ff ff e9 35 fa ff ff 0f 0b eb f1 <0f> 0b e9 f4 fe ff ff 48 8b 3f 48 c7 c6 8b 77 f7 c1 e8 65 be 53 ff
RSP: 0018:ffffccd041063b80 EFLAGS: 00010286
RAX: ffff8928ed288000 RBX: ffff892b5f4c0000 RCX: ffffccd041063b70
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffccd041063b20
RBP: ffffccd041063c40 R08: ffffffffc1f6ec60 R09: 0000000000000000
R10: 0000000000000001 R11: ffff892bef59ce40 R12: ffff8928a7982008
R13: ffff892895a92a90 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff892c4e170000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056174610a018 CR3: 000000000129e003 CR4: 0000000000f72ef0
PKRU: 55555554
Call Trace:
 <TASK>
 ? iwl_mvm_mac_ampdu_action+0xfe/0x270 [iwlmvm]
 iwl_mvm_mac_ampdu_action+0xfe/0x270 [iwlmvm]
 ? hrtimer_start_range_ns+0x100/0x2b0
 drv_ampdu_action+0xd8/0x190 [mac80211]
 __ieee80211_start_rx_ba_session+0x4c0/0x710 [mac80211]
 ? __remove_hrtimer+0x41/0xa0
 ieee80211_process_addba_request+0x9b/0xd0 [mac80211]
 ieee80211_iface_work+0x72/0x190 [mac80211]
 cfg80211_wiphy_work+0xfb/0x170 [cfg80211]
 process_one_work+0x18d/0x340
 worker_thread+0x256/0x3a0
 ? __pfx_worker_thread+0x10/0x10
 kthread+0xf9/0x240
 ? __pfx_kthread+0x10/0x10
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x152/0x180
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1a/0x30
 </TASK>