{
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_mvm_tx_resp *beacon_notify_hdr;
+       struct ieee80211_vif *csa_vif;
        u64 tsf;
 
        lockdep_assert_held(&mvm->mutex);
                     mvm->ap_last_beacon_gp2,
                     le32_to_cpu(beacon_notify_hdr->initial_rate));
 
-       if (unlikely(mvm->csa_vif && mvm->csa_vif->csa_active)) {
-               if (!ieee80211_csa_is_complete(mvm->csa_vif)) {
-                       ieee80211_csa_update_counter(mvm->csa_vif);
-                       iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm->csa_vif);
+       csa_vif = rcu_dereference_protected(mvm->csa_vif,
+                                           lockdep_is_held(&mvm->mutex));
+       if (unlikely(csa_vif && csa_vif->csa_active)) {
+               if (!ieee80211_csa_is_complete(csa_vif)) {
+                       ieee80211_csa_update_counter(csa_vif);
+                       iwl_mvm_mac_ctxt_beacon_changed(mvm, csa_vif);
                } else {
-                       ieee80211_csa_finish(mvm->csa_vif);
-                       mvm->csa_vif = NULL;
+                       ieee80211_csa_finish(csa_vif);
+                       RCU_INIT_POINTER(mvm->csa_vif, NULL);
                }
        }
 
 
 
        mutex_lock(&mvm->mutex);
 
+       /* Handle AP stop while in CSA */
+       if (rcu_access_pointer(mvm->csa_vif) == vif)
+               RCU_INIT_POINTER(mvm->csa_vif, NULL);
+
        mvmvif->ap_ibss_active = false;
        mvm->ap_last_beacon_gp2 = 0;
 
                                          struct cfg80211_chan_def *chandef)
 {
        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+       struct ieee80211_vif *csa_vif;
 
        mutex_lock(&mvm->mutex);
-       if (WARN(mvm->csa_vif && mvm->csa_vif->csa_active,
+
+       csa_vif = rcu_dereference_protected(mvm->csa_vif,
+                                           lockdep_is_held(&mvm->mutex));
+       if (WARN(csa_vif && csa_vif->csa_active,
                 "Another CSA is already in progress"))
                goto out_unlock;
 
        IWL_DEBUG_MAC80211(mvm, "CSA started to freq %d\n",
                           chandef->center_freq1);
-       mvm->csa_vif = vif;
+       rcu_assign_pointer(mvm->csa_vif, vif);
 
 out_unlock:
        mutex_unlock(&mvm->mutex);
 
        /* Indicate if device power save is allowed */
        bool ps_disabled;
 
-       struct ieee80211_vif *csa_vif;
+       struct ieee80211_vif __rcu *csa_vif;
 
        /* system time of last beacon (for AP/GO interface) */
        u32 ap_last_beacon_gp2;