From: Jan Kiszka It seems that there is a gremlin sleeping in net/core/netpoll.c:find_skb(). Even if no more buffers are available through "skbs", "skb" is dereferenced anyway. The tiny patch should fix it. Signed-off-by: Andrew Morton --- 25-akpm/net/core/netpoll.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff -puN net/core/netpoll.c~null-pointer-bug-in-netpollc net/core/netpoll.c --- 25/net/core/netpoll.c~null-pointer-bug-in-netpollc 2005-03-19 22:41:22.000000000 -0800 +++ 25-akpm/net/core/netpoll.c 2005-03-19 22:41:22.000000000 -0800 @@ -165,10 +165,11 @@ repeat: if (!skb) { spin_lock_irqsave(&skb_list_lock, flags); skb = skbs; - if (skb) + if (skb) { skbs = skb->next; - skb->next = NULL; - nr_skbs--; + skb->next = NULL; + nr_skbs--; + } spin_unlock_irqrestore(&skb_list_lock, flags); } _