--- zzzz-none-000/linux-2.6.32.61/block/elevator.c	2013-06-10 09:43:48.000000000 +0000
+++ ar9-7330-650/linux-2.6.32.61/block/elevator.c	2015-04-09 11:31:23.000000000 +0000
@@ -286,6 +286,7 @@
 	data = elevator_init_queue(q, eq);
 	if (!data) {
 		kobject_put(&eq->kobj);
+        kfree(eq);
 		return -ENOMEM;
 	}
 
@@ -479,6 +480,10 @@
 	struct request *__rq;
 	int ret;
 
+	/*= AVM/WK 20140603:  Crash fix, don't access elevator of dead queue =*/
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return ELEVATOR_NO_MERGE;
+
 	/*
 	 * First try one-hit cache.
 	 */
@@ -512,6 +517,10 @@
 {
 	struct elevator_queue *e = q->elevator;
 
+	/*= AVM/WK 20140603:  Crash fix, don't access elevator of dead queue =*/
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return;
+
 	if (e->ops->elevator_merged_fn)
 		e->ops->elevator_merged_fn(q, rq, type);
 
@@ -538,6 +547,11 @@
 
 void elv_requeue_request(struct request_queue *q, struct request *rq)
 {
+
+	/*= AVM/WK 20140603:  Crash fix, don't access elevator of dead queue =*/
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return;
+
 	/*
 	 * it already went through dequeue, we need to decrement the
 	 * in_flight count again
@@ -556,6 +570,11 @@
 void elv_drain_elevator(struct request_queue *q)
 {
 	static int printed;
+
+	/*= AVM/WK 20140603:  Crash fix, don't access elevator of dead queue =*/
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return;
+
 	while (q->elevator->ops->elevator_dispatch_fn(q, 1))
 		;
 	if (q->nr_sorted == 0)
@@ -601,6 +620,10 @@
 	unsigned ordseq;
 	int unplug_it = 1;
 
+	/*= AVM/WK 20140603:  Crash fix, don't access elevator of dead queue =*/
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return;
+
 	trace_block_rq_insert(q, rq);
 
 	rq->q = q;
@@ -745,6 +768,10 @@
 {
 	struct elevator_queue *e = q->elevator;
 
+	/*= AVM/WK 20140603:  Crash fix, don't access elevator of dead queue =*/
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return 1;
+
 	if (!list_empty(&q->queue_head))
 		return 0;
 
@@ -759,6 +786,10 @@
 {
 	struct elevator_queue *e = q->elevator;
 
+	/*= AVM/WK 20140603:  Crash fix, don't access elevator of dead queue =*/
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return NULL;
+
 	if (e->ops->elevator_latter_req_fn)
 		return e->ops->elevator_latter_req_fn(q, rq);
 	return NULL;
@@ -768,6 +799,10 @@
 {
 	struct elevator_queue *e = q->elevator;
 
+	/*= AVM/WK 20140603:  Crash fix, don't access elevator of dead queue =*/
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return NULL;
+
 	if (e->ops->elevator_former_req_fn)
 		return e->ops->elevator_former_req_fn(q, rq);
 	return NULL;
@@ -788,6 +823,10 @@
 {
 	struct elevator_queue *e = q->elevator;
 
+	/*= AVM/WK 20140603:  Crash fix, don't access elevator of dead queue =*/
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return;
+
 	if (e->ops->elevator_put_req_fn)
 		e->ops->elevator_put_req_fn(rq);
 }
@@ -796,6 +835,10 @@
 {
 	struct elevator_queue *e = q->elevator;
 
+	/*= AVM/WK 20140603:  Crash fix, don't access elevator of dead queue =*/
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return ELV_MQUEUE_NO;
+
 	if (e->ops->elevator_may_queue_fn)
 		return e->ops->elevator_may_queue_fn(q, rw);
 
@@ -824,6 +867,10 @@
 {
 	struct elevator_queue *e = q->elevator;
 
+	/*= AVM/WK 20140603:  Crash fix, don't access elevator of dead queue =*/
+	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
+		return;
+
 	/*
 	 * request is released from the driver, io must be done
 	 */
@@ -995,6 +1042,7 @@
 	data = elevator_init_queue(q, e);
 	if (!data) {
 		kobject_put(&e->kobj);
+        kfree(e);
 		return 0;
 	}