On Thu, May 2, 2013 at 12:41 PM, Bing Zhao <bzhao@xxxxxxxxxxx> wrote: > You are right, this crash also existed before the patch in "deferred scan" path. > Please try attached patch address this issue. I haven't tested it yet, but it doesn't look like a fix to me. Surely the crash here is that the timer_fn is running and using data that has been freed, like the netdev and the workqueue. mwifiex_free_adapter() is called at the end of mwifiex_remove_card(), after it has freed a whole load of that stuff. If you are trying to stop the timer at this point, you are way too late. Daniel -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html