Hi, Here, I was lost by line code in ip_route_output_slow(): rth = dst_alloc(&ipv4_dst_ops); It tries to allocate a rtable entry with ipv4_dst_ops, which is defined as struct dst_ops { unsigned short family; unsigned short protocol; unsigned gc_thresh; int (*gc)(void); struct dst_entry * (*check)(struct dst_entry *, __u32 cookie); struct dst_entry * (*reroute)(struct dst_entry *, struct sk_buff *); void (*destroy)(struct dst_entry *); struct dst_entry * (*negative_advice)(struct dst_entry *); void (*link_failure)(struct sk_buff *); int entry_size; atomic_t entries; kmem_cache_t *kmem_cachep; }; And it's initialized as : struct dst_ops ipv4_dst_ops = { family: AF_INET, protocol: __constant_htons(ETH_P_IP), gc: rt_garbage_collect, check: ipv4_dst_check, reroute: ipv4_dst_reroute, destroy: ipv4_dst_destroy, negative_advice: ipv4_negative_advice, link_failure: ipv4_link_failure, entry_size: sizeof(struct rtable), }; It means: ipv4_dst_ops.kmem_cachep == NULL Then in dst_alloc(), I found: void * dst_alloc(struct dst_ops * ops) { struct dst_entry * dst; if (ops->gc && atomic_read(&ops->entries) > ops->gc_thresh) { if (ops->gc()) return NULL; } ????====> dst = kmem_cache_alloc(ops->kmem_cachep, SLAB_ATOMIC); ........... } This is equal to: dst = kmem_cache_alloc(NULL, SLAB_ATOMIC); My question is how can it work, not crash ?? I found similar situation in several other place, it seems an acceptable practice. Anyone could shed me some light? Thanks GF -- Kernelnewbies: Help each other learn about the Linux kernel. Archive: http://mail.nl.linux.org/kernelnewbies/ FAQ: http://kernelnewbies.org/faq/