It must be that skb->dev was changed to NULL inside of
__netif_receive_skb_core, otherwise we would have crashed much
earlier. Also, orig_dev is saved at the beginning. Possibly a device
is layered on top of the original device.

On Mon, Jan 11, 2016 at 5:06 PM, Eric Dumazet [off-list ref] wrote:

On Tue, 2016-01-12 at 02:51 +0200, Ivaylo Dimitrov wrote:

quoted

I put some additional printks around that code, and it turned out that
skb->dev is null, so "if (unlikely(skb->dev != orig_dev))" succeeds, but
"&skb->dev->ptype_specific" oopses.

Nice find !

Now lets find what possibly called netif_rx() with skb->dev == NULL

(This is illegal)