Most recent kernel where this bug did not occur: 2.6.13.2
Distribution: vanilla
Hardware Environment: AMD Duron/VIA KT133/Realtek 8110/8169
Software Environment:  
Problem Description: Kernel oops and kernel panic occurs regularly.

Steps to reproduce: Moderate LAN traffic through 8169 NIC with vlan.

Kernel oops:

Badness in __kfree_skb at net/core/skbuff.c:291
 [<c03e2ff1>] __kfree_skb+0xb1/0x100
 [<c03e658d>] sk_stream_kill_queues+0x4d/0x180
 [<c042e14c>] tcp_v4_destroy_sock+0x1c/0x180
 [<c041d4d7>] tcp_destroy_sock+0x47/0x120
 [<c042561a>] tcp_rcv_state_process+0x51a/0x9c0
 [<c042d1b9>] tcp_v4_do_rcv+0x99/0x120
 [<c042d7d0>] tcp_v4_rcv+0x590/0x770
 [<c0413c7f>] ip_local_deliver+0xbf/0x1c0
 [<c0414260>] ip_local_deliver_finish+0x0/0x130
 [<c04140d6>] ip_rcv+0x356/0x4e0
 [<c0414390>] ip_rcv_finish+0x0/0x270
 [<c01b1165>] pathrelse_and_restore+0x45/0x50
 [<c03e88c7>] netif_receive_skb+0x127/0x190
 [<c036eeac>] rtl8169_rx_vlan_skb+0x15c/0x1a0
 [<c037134a>] rtl8169_rx_interrupt+0x18a/0x400
 [<c0371a50>] pci_dma_sync_single_for_device+0x0/0x1
 [<c03716cb>] rtl8169_interrupt+0x10b/0x150
 [<c01385a0>] handle_IRQ_event+0x30/0x70
 [<c0138682>] __do_IRQ+0xa2/0xe0
 [<c0448056>] tcp_in_window+0x496/0x4a0
 [<c0104d79>] do_IRQ+0x19/0x30
 [<c0103292>] common_interrupt+0x1a/0x20
 [<c0139ad6>] find_get_page+0x26/0x30
 [<c0158373>] __find_get_block_slow+0x53/0x170
 [<c044a1c1>] ipt_do_table+0x251/0x330
 [<c0159190>] __find_get_block+0x80/0xe0
 [<c0159227>] __getblk+0x37/0x70
 [<c01b15f7>] search_by_key+0x97/0xd80
 [<c03edbfc>] neigh_resolve_output+0xec/0x190
 [<c0416c6e>] ip_finish_output+0xfe/0x220
 [<c041730a>] ip_queue_xmit+0x36a/0x510
 [<c0419300>] dst_output+0x0/0x30
 [<c019aab9>] make_cpu_key+0x59/0x70
 [<c019cfad>] inode2sd+0xfd/0x160
 [<c012cc20>] autoremove_wake_function+0x0/0x60
 [<c019aab9>] make_cpu_key+0x59/0x70
 [<c019d326>] reiserfs_update_sd_size+0xa6/0x220
 [<c0139b3f>] find_lock_page+0x1f/0x90
 [<c019aab9>] make_cpu_key+0x59/0x70
 [<c01a8424>] reiserfs_dirty_inode+0x74/0x90
 [<c01a2365>] reiserfs_submit_file_region_for_write+0x215/0x280
 [<c01a3342>] reiserfs_file_write+0x4f2/0x690
 [<c0414260>] ip_local_deliver_finish+0x0/0x130
 [<c04140d6>] ip_rcv+0x356/0x4e0
 [<c0414390>] ip_rcv_finish+0x0/0x270
 [<c03e88c7>] netif_receive_skb+0x127/0x190
 [<c036eeac>] rtl8169_rx_vlan_skb+0x15c/0x1a0
 [<c03713a9>] rtl8169_rx_interrupt+0x1e9/0x400
 [<c03716b5>] rtl8169_interrupt+0xf5/0x150
 [<c0156ad7>] vfs_write+0xa7/0x180
 [<c0156c81>] sys_write+0x51/0x80
 [<c01030d5>] syscall_call+0x7/0xb 

The rtl8169 is eth2 here and has vlans eth2.2 through eth2.10

VLAN setup is done by the following basic script:
=============================
#!/bin/zsh

VC=/sbin/vconfig
ETH=eth2

for i in {2..10}; do

 ${VC} add ${ETH} $i
 ip ad add 192.168.$i.254 dev eth2.$i
 ip li set eth2.$i up
 ip ro add 192.168.$i.0/24 dev eth2.$i

done
============================

I also experience dead loop/fix it messages from time to time. (Only ono one
specific vlan, not all!)