kern/126850: Panic in if_vlan.c

[Damien Deville]

>Number:         126850
>Category:       kern
>Synopsis:       Panic in if_vlan.c
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Aug 26 10:00:10 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Damien Deville
>Release:        RELENG_7
>Organization:
NETASQ
>Environment:
FreeBSD barbar.netasq.com 7.0-STABLE FreeBSD 7.0-STABLE #2: Mon Aug  12 15:56:16 CEST 2008     pb at barbar.netasq.com:/usr/obj/usr/src/sys/GENERIC  i386
>Description:
On RELENG_7 after August 12th, and also on HEAD it is possible to crash the system using the following commands:

ifconfig vlan0 create
ifconfig vlan0 -vlandev

Crash is located in if_vlan.c in vlan_unconfig_locked() when dereferencing a NULL pointer (ifv->ifv_trunk) to access parent interface using PARENT macro.

Crash appeared after svn revision 181607 on RELENG_7: MFC of vlan attach notification support.

>How-To-Repeat:
Run the following commands:

ifconfig vlan0 create
ifconfig vlan0 -vlandev
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: