Hi, After doing insmod/rmmod of libertas, kmemleak found: unreferenced object 0xe90f1398 (size 64): comm "rmmod", pid 836, jiffies 4294944467 (age 34.620s) hex dump (first 32 bytes): 58 cd 24 e9 58 cd 24 e9 02 00 00 00 c0 13 0f e9 X.$.X.$......... 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<b0747a00>] kmemleak_alloc+0x26/0x44 [<b049eff1>] __kmalloc+0xf3/0x176 [<b0740aae>] cfg80211_disconnected+0x3e/0xc8 [<b06008c9>] lbs_disconnect+0x73/0x86 [<b0600955>] lbs_cfg_disconnect+0x79/0x88 [<b0741c20>] __cfg80211_disconnect+0xf5/0x148 [<b072cd8f>] cfg80211_netdev_notifier_call+0x253/0x452 [<b075781b>] notifier_call_chain+0x2a/0x4b [<b04344f6>] __raw_notifier_call_chain+0x13/0x15 [<b0434509>] raw_notifier_call_chain+0x11/0x13 [<b06a51ff>] call_netdevice_notifiers+0x41/0x48 [<b06a5247>] __dev_close_many+0x41/0x8b [<b06a5323>] dev_close_many+0x58/0xa8 [<b06a5401>] rollback_registered_many+0x8e/0x1f8 [<b06a5593>] rollback_registered+0x28/0x34 [<b06a66b0>] unregister_netdevice_queue+0x51/0x6e By adding some printks I have found that cfg80211_disconnected() does indeed queue an event to be processed in cfg80211_wq on the eth0 device, but by the time cfg80211_process_rdev_events() is called, eth0 is no longer present in the rdev's netdev_list, so the event never gets processed (or freed). Daniel -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html