Ok, here is the problem: I kernel thread reads some data from a socket (where the peer closes it first), then it closes the socket by trying to read any data left in it and closing it with sock_release(). Then the thread exits and the kernel oopses with often not-so-helpful oops (i.e. nothing that has to do with the thread). Most of the times it oopses somewhere in do_exit()... Below is a sample of ksymoops-ed oops. Does anyone have any clue as to what it might be? I've looked in the code and it all seems ok, as it is fairly simple code... Here is a sample: >>EIP; c01ebc7c <sem_exit+1c/230> <===== Trace; c0122827 <acct_process+47/8f> Trace; c011e8e8 <do_exit+c8/260> Trace; c011ea2f <do_exit+20f/260> Trace; c012c5e2 <do_munmap+262/280> Trace; f88f1897 <END_OF_CODE+f4d1/????> Trace; c011eaae <sys_exit+e/10> Trace; c01072fb <system_call+33/38> Trace; f88f1897 <END_OF_CODE+f4d1/????> Trace; c01058ad <kernel_thread+2d/30> Trace; f88e68b0 <__module_using_checksums+44ea/????> Code; c01ebc7c <sem_exit+1c/230> 00000000 <_EIP>: Code; c01ebc7c <sem_exit+1c/230> <===== 0: 8b 43 1c mov 0x1c(%ebx),%eax <===== Code; c01ebc7f <sem_exit+1f/230> 3: 83 f8 ff cmp $0xffffffff,%eax Code; c01ebc82 <sem_exit+22/230> 6: 8d 88 ff 7f 00 00 lea 0x7fff(%eax),%ecx Code; c01ebc88 <sem_exit+28/230> c: 89 c2 mov %eax,%edx Code; c01ebc8a <sem_exit+2a/230> e: 0f 4e d1 cmovle %ecx,%edx Code; c01ebc8d <sem_exit+2d/230> 11: 31 ff xor %edi,%edi Code; c01ebc8f <sem_exit+2f/230> 13: 81 00 00 00 00 00 addl $0x0,(%eax) Puzzled to the point of insanity, -- Luben - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html