+/* Purge after the grace period: a late ppp_input() may still queue an
+ * skb on pch->file.rq before the last RCU reader drains.
+ */
+static void ppp_release_channel_free(struct rcu_head *rcu)
+{
+	struct channel *pch = container_of(rcu, struct channel, rcu);
+
+	skb_queue_purge(&pch->file.xq);
+	skb_queue_purge(&pch->file.rq);
+	kfree(pch);
+}
+
  /*
   * Drop a reference to a ppp channel and free its memory if the refcount reaches
   * zero.

@@ -3581,9 +3594,7 @@ static void ppp_release_channel(struct channel *pch)
  		pr_err("ppp: destroying undead channel %p !\n", pch);
  		return;
  	}
-	skb_queue_purge(&pch->file.xq);
-	skb_queue_purge(&pch->file.rq);
-	kfree(pch);
+	call_rcu(&pch->rcu, ppp_release_channel_free);
  }
  
  static void __exit ppp_cleanup(void)