On Sat, 2013-09-28 at 16:03 -0700, Eric Dumazet wrote:

Unfortunately, skb->len is unsafe : hardware might already sent the
packet and TX completion have freed it.

You must cache skb->len in a variable before allowing hardware to send
the frame.

More exactly you must call netdev_sent_queue() _before_ giving skb to
hardware, or netdev_completed_queue() might panic.