Backtrace

WARNING: CPU: 0 PID: 63591 at drivers/net/wireless/realtek/rtw88/tx.c:155 rtw_tx_report_purge_timer+0x20/0x50 [rtw88]
Modules linked in: rfcomm ccm nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_tables_set nft_chain_nat ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_mangle iptable_raw iptable_security ip_set nf_tables nfnetlink ip6table_filter ip6_tables iptable_filter cmac bnep nouveau ttm sunrpc vfat fat uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 btusb videobuf2_common btrtl btbcm btintel bluetooth videodev ecdh_generic ecc mc x86_pkg_temp_thermal rtwpci intel_powerclamp mei_hdcp intel_rapl_msr iTCO_wdt iTCO_vendor_support coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel rtw88 intel_cstate intel_uncore mac80211 intel_rapl_perf joydev cfg80211 pcspkr hp_wmi sparse_keymap rfkill libarc4 wmi_bmof snd_sof_pci snd_sof_intel_byt snd_sof_intel_ipc
 snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_xtensa_dsp snd_sof_intel_hda snd_sof snd_soc_skl snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core snd_soc_acpi_intel_match snd_soc_acpi snd_soc_core snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi snd_compress ac97_bus snd_pcm_dmaengine ledtrig_audio snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer processor_thermal_device intel_rapl_common snd int3400_thermal int340x_thermal_zone acpi_thermal_rel i2c_i801 mei_me acpi_tad soundcore acpi_pad mei intel_soc_dts_iosf hp_accel lis3lv02d intel_pch_thermal hp_wireless binfmt_misc ip_tables i915 rtsx_pci_sdmmc mmc_core mxm_wmi i2c_algo_bit cec crc32c_intel drm_kms_helper serio_raw drm rtsx_pci r8169 wmi video fuse
CPU: 0 PID: 63591 Comm: kworker/0:2 Tainted: G        W         5.6.6-300.fc32.x86_64 #1
Hardware name: HP HP Pavilion Notebook 15-bc5xxx/8640, BIOS F.06 09/03/2019
Workqueue: events engine_retire [i915]
RIP: 0010:rtw_tx_report_purge_timer+0x20/0x50 [rtw88]
Code: 84 00 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 8b 47 f0 85 c0 75 01 c3 41 54 55 53 48 89 fb 48 c7 c7 a8 7b bc c0 e8 a7 26 58 d5 <0f> 0b 4c 8d 63 d8 4c 89 e7 e8 12 95 ed d5 48 8d 7b e0 48 89 c5 e8
RSP: 0018:ffffbf90c0003e78 EFLAGS: 00010296
RAX: 0000000000000025 RBX: ffff9ceac4655cf8 RCX: 0000000000000007
RDX: 00000000fffffff8 RSI: 0000000000000096 RDI: ffff9cead5c19cc0
RBP: ffff9cead5c1bf80 R08: 0000000000000d74 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000001 R12: ffff9ceac4655cf8
R13: ffffffffc0b592f0 R14: 0000000000000001 R15: ffff9ceac4655cf8
FS:  0000000000000000(0000) GS:ffff9cead5c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f66208ac060 CR3: 000000000f60a001 CR4: 00000000003606f0
Call Trace:
 <IRQ>
 call_timer_fn+0x2d/0x130
 __run_timers.part.0+0x167/0x240
 ? timerqueue_add+0x96/0xb0
 ? enqueue_hrtimer+0x39/0x90
 ? __hrtimer_run_queues+0x149/0x280
 run_timer_softirq+0x26/0x50
 __do_softirq+0xe9/0x2dc
 irq_exit+0xcf/0x110
 smp_apic_timer_interrupt+0x78/0x130
 apic_timer_interrupt+0xf/0x20
 </IRQ>
RIP: 0010:kfree+0x7d/0x200
Code: 01 48 8b 45 08 48 8d 50 ff a8 01 48 0f 45 ea 48 8b 55 08 48 8d 42 ff 83 e2 01 48 0f 44 c5 48 8b 00 f6 c4 02 0f 84 ef 00 00 00 <4c> 8b 6d 18 48 8d 54 24 08 48 89 e6 48 89 1c 24 48 c7 44 24 08 00
RSP: 0018:ffffbf90c5343e00 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
RAX: 0017ffffc0000200 RBX: ffff9cea383b5d70 RCX: 00000000810000bd
RDX: 0000000000000000 RSI: 00000000810000bd RDI: ffff9cea383b5d70
RBP: ffffe30d47e0ed40 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffffc03b32ee
R13: ffff9cead41bc000 R14: 0000000000000000 R15: ffff9ce84401c000
 ? i915_request_retire+0x1fe/0x340 [i915]
 i915_request_retire+0x1fe/0x340 [i915]
 engine_retire+0xa6/0xf0 [i915]
 process_one_work+0x1b4/0x380
 worker_thread+0x53/0x3e0
 ? process_one_work+0x380/0x380
 kthread+0x115/0x140
 ? __kthread_bind_mask+0x60/0x60
 ret_from_fork+0x35/0x40