Subject: Re: [Patch net] garp: fix a NULL pointer dereference bug

From: Cong Wang <[email-masked]>
Date: Mon, 04 Mar 2013 11:41:38 +0800

On Mon, 2013-03-04 at 11:36 +0800, Cong Wang wrote:
> From: Cong Wang <[email-masked]>
> 
> A NULL-deref bug was reported in:
> https://bugzilla.kernel.org/show_bug.cgi?id=54281
> when deleting a vlan interface:
> 
> # ip link  del em1.57
> BUG: unable to handle kernel NULL pointer dereference at (null)
> IP: [<ffffffffa03c356f>] garp_uninit_applicant+0x2f/0xd0 [garp]
> ...
> 
> This is probably app->pdu is NULL'ed in garp_pdu_rcv()
> in BH, while garp_uninit_applicant() only holds rtnl lock
> which is not enough to prevent this. 
> 
> OTOH, garp_pdu_queue() should ways be called with the spin lock.
> 
> 
> Reported-by: [email-masked]

I can't reproduce it locally, so please help to test it. I only did
compiling test.

Thanks!