SH4 linux2.4.20 tcp_transmit_skb Oops

Oops is:
# Unable to handle kernel NULL pointer dereference at virtual address
00000004
pc = 8c0d77a6
*pde = 00000000
Oops: 0000

From Oops, It seems the crash happend in
tcp_output.c:268
tp->af_specific->send_check(sk, th, skb->len, skb);


the asm code at 8c0d77a6 is at 386 in the following
tp->af_specific->send_check(sk, th, skb->len, skb);
376: 9e 98 mov.w 4b6
<tcp_transmit_skb+0x3d6>,r8 ! 0xbc
378: e3 61 mov r14,r1
37a: f4 53 mov.l @(16,r15),r3
37c: d3 64 mov r13,r4
37e: a3 65 mov r10,r5
380: f2 67 mov.l @r15,r7
382: 8c 31 add r8,r1
384: 18 51 mov.l @(32,r1),r1
386: 11 51 mov.l @(4,r1),r1
388: 0b 41 jsr @r1
38a: 37 56 mov.l @(28,r3),r6

tp->af_specific is NULL? how can this happen?

Oops only happens when I enable some code in the eth driver, and after
a few tcp traffic, but I can not find out where cause this problem. Is
there anybody have idea about this? Your suggestion is great
appreciated!

-Li Ming