Hi Johannes,
Thanks for your help, I just make some tests with the patch you provided.
Yes, there is none warning calltrace again, and none other calltrace too.
But for the tmp_list, when we abort a roc and add to the tail of tmp_list, We will delete it from tmp_list in the work async, we need to modify the prev and next pointer of the head of tmp_list, I think they are freed from the stack of function ieee80211_roc_purge(), it is dangerous.
Felix Liao
��.n��������+%������w��{.n�����{���zW����ܨ}���Ơz�j:+v�����w����ޙ��&�)ߡ�a����z�ޗ���ݢj��w�f
