On Fri, 2013-12-06 at 18:34 +0800, Yeoh Chun-Yeow wrote: > > diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c > > index 5476ad9..a7fad0d 100644 > > --- a/net/mac80211/mesh.c > > +++ b/net/mac80211/mesh.c > > @@ -1051,7 +1051,8 @@ int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata) > > /* Remove the CSA and MCSP elements from the beacon */ > > tmp_csa_settings = rcu_dereference(ifmsh->csa); > > rcu_assign_pointer(ifmsh->csa, NULL); > > - kfree_rcu(tmp_csa_settings, rcu_head); > > + if (tmp_csa_settings) > > + kfree_rcu(tmp_csa_settings, rcu_head); > > Yes, this solves the problem of kernel oops. Great, thanks for testing! I'll send a v9 with fixes for Simon's comments and rebase it on top of his lock fix as well. Today is holiday here, so probably on Monday. -- Luca. ��.n��������+%������w��{.n�����{���zW����ܨ}���Ơz�j:+v�����w����ޙ��&�)ߡ�a����z�ޗ���ݢj��w�f