[Bug 285813] Panic (NULL deref) in arptimer

[email protected] Thu, 21 May 2026 12:36:39 +0000

Newsgroups	gmane.os.freebsd.devel.net
Message-ID	<[email protected]/bugzilla/>

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285813

Teddy Engel <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[email protected]

--- Comment #15 from Teddy Engel <[email protected]> ---
(In reply to Kristof Provost from comment #13)

I think this was bang on the money. I ran some testing with instrumentation and
found out that when callout_stop() returned 0, the timer callback (e.g.,
arptimer()) was currently executing on another CPU and we proceeded to free the
llentry via LLE_FREE_LOCKED(), causing use-after-free when the timer callback
subsequently accessed the freed memory.

Sent a candidate PR here for review:
https://github.com/freebsd/freebsd-src/pull/2219

-- 
You are receiving this mail because:
You are the assignee for the bug.