The tg3 driver crashes the system with a message unable to handle kernel NULL pointer dereference.

Issue

• The system panic's while reading a /proc/xxx/net/dev file.
• You see a message like the below in the log buffer

BUG: unable to handle kernel NULL pointer dereference at 0000000000000118
IP: [<ffffffffa0173f0e>] tg3_get_nstats+0x1e/0x360 [tg3]
PGD 405ce3067 PUD 42a729067 PMD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:02.0/0000:03:00.3/resource
CPU 6 
Modules linked in: ipmi_devintf mlx4_en mlx4_core tcp_diag inet_diag bridge nfnetlink_queue nfnetlink_log nfnetlink bluetooth rfkill mptctl mptbase sctp libcrc32c nls_utf8 autofs4 cpufreq_ondemand freq_table pcc_cpufreq bonding 8021q garp stp llc ipv6 dm_multipath iTCO_wdt iTCO_vendor_support microcode hpilo power_meter hpwdt sg tg3 igb i2c_algo_bit i2c_core ptp pps_core serio_raw lpc_ich mfd_core ioatdma dca shpchp ext4 jbd2 mbcache sd_mod crc_t10dif pata_acpi ata_generic ata_piix hpsa dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ipmi_devintf]

Pid: 17688, comm: sadc Not tainted 2.6.32-431.29.2.el6.x86_64 #1 HP ProLiant DL380p Gen8
RIP: 0010:[<ffffffffa0173f0e>]  [<ffffffffa0173f0e>] tg3_get_nstats+0x1e/0x360 [tg3]
RSP: 0018:ffff8807a0f31d08  EFLAGS: 00010282
RAX: 000000000000c2d4 RBX: 0000000000000000 RCX: 0000000000000008
RDX: 000000000000c2d4 RSI: ffff880438266020 RDI: ffff8804382666e0
RBP: ffff8807a0f31d38 R08: ffffffff811ae630 R09: 2020202033323736
R10: 2020302020202030 R11: 0000000000000246 R12: ffff8804382666e0
R13: ffff8804382666e0 R14: 0000000000000400 R15: ffff8807a0f31e60
FS:  00007ff1bf2dc700(0000) GS:ffff88044e400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000118 CR3: 0000000300175000 CR4: 00000000000407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process sadc (pid: 17688, threadinfo ffff8807a0f30000, task ffff88044ffcd500)
Stack:
 ffff8807a0f31d28 ffff8807a0f31d78 ffff880438266020 ffff8804382666e4
<d> ffff8804382666e0 0000000000000400 ffff8807a0f31d68 ffffffffa0174294
<d> 0000000000000001 ffff880837031d40 ffff880438266020 ffff880438266020
Call Trace:
 [<ffffffffa0174294>] tg3_get_stats+0x44/0x90 [tg3]
 [<ffffffff81458fe2>] dev_get_stats+0x22/0x50
 [<ffffffff81459b28>] dev_seq_show+0x28/0x120
 [<ffffffff8145afb2>] ? dev_seq_start+0x22/0x80
 [<ffffffff811ae722>] seq_read+0xf2/0x400
 [<ffffffff811f3cce>] proc_reg_read+0x7e/0xc0
 [<ffffffff81189645>] vfs_read+0xb5/0x1a0
 [<ffffffff81189781>] sys_read+0x51/0x90
 [<ffffffff810e1bfe>] ? __audit_syscall_exit+0x25e/0x290
 [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b
Code: ff 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 56 41 55 41 54 53 48 83 ec 10 0f 1f 44 00 00 48 8b 9f 28 10 00 00 49 89 fc <8b> 93 18 01 00 00 8b 83 1c 01 00 00 8b 8b 24 01 00 00 48 c1 e2 
RIP  [<ffffffffa0173f0e>] tg3_get_nstats+0x1e/0x360 [tg3]
 RSP <ffff8807a0f31d08>
CR2: 0000000000000118
crash>