From owner-freebsd-net@FreeBSD.ORG  Wed Aug 13 15:20:36 2008
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 01C741065671
	for <freebsd-net@freebsd.org>; Wed, 13 Aug 2008 15:20:36 +0000 (UTC)
	(envelope-from damien.deville@netasq.com)
Received: from netasq.netasq.com (netasq.netasq.com [213.30.137.178])
	by mx1.freebsd.org (Postfix) with ESMTP id C42298FC12
	for <freebsd-net@freebsd.org>; Wed, 13 Aug 2008 15:20:35 +0000 (UTC)
	(envelope-from damien.deville@netasq.com)
Received: from barbar.netasq.com (unknown [10.0.0.126])
	by netasq.netasq.com (Postfix) with ESMTP id 0F673435E1
	for <freebsd-net@freebsd.org>; Wed, 13 Aug 2008 17:20:34 +0200 (CEST)
Message-ID: <48A2FBBD.1000503@netasq.com>
Date: Wed, 13 Aug 2008 17:20:29 +0200
From: Damien Deville <damien.deville@netasq.com>
User-Agent: Thunderbird 2.0.0.16 (X11/20080730)
MIME-Version: 1.0
To: freebsd-net@freebsd.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: RELENG_7 crash in if_vlan
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: damien.deville@netasq.com
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 13 Aug 2008 15:20:36 -0000

Hi,

On today's checkout of RELENG_7 it is possible to crash the system using 
the following commands:

ifconfig vlan0 create
ifconfig vlan0 -vlandev

Crash is located in if_vlan.c in vlan_unconfig_locked() when 
dereferencing a NULL pointer (ifv->ifv_trunk) to access parent interface 
using PARENT macro.

Damien
-- 
Damien Deville
R&D engineer
damien.deville@netasq.com
http://www.netasq.com

NETASQ - We secure IT