--- x/drivers/net/wan/lapbether.c
+++ y/drivers/net/wan/lapbether.c
@@ -139,7 +139,10 @@ static int lapbeth_rcv(struct sk_buff *s
 	skb_pull(skb, 2);	/* Remove the length bytes */
 	skb_trim(skb, len);	/* Set the length of the data */
 
+	/* still with rcu lock held */
+	spin_unlock_bh(&lapbeth->up_lock);
 	err = lapb_data_received(lapbeth->axdev, skb);
+	spin_lock_bh(&lapbeth->up_lock);
 	if (err != LAPB_OK) {
 		printk(KERN_DEBUG "lapbether: lapb_data_received err - %d\n", err);
 		goto drop_unlock;
@@ -343,6 +346,7 @@ static int lapbeth_close(struct net_devi
 	struct lapbethdev *lapbeth = netdev_priv(dev);
 	int err;
 
+	synchronize_rcu();
 	spin_lock_bh(&lapbeth->up_lock);
 	lapbeth->up = false;
 	spin_unlock_bh(&lapbeth->up_lock);