https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285813
Teddy Engel <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |[email protected] --- Comment #15 from Teddy Engel <[email protected]> --- (In reply to Kristof Provost from comment #13) I think this was bang on the money. I ran some testing with instrumentation and found out that when callout_stop() returned 0, the timer callback (e.g., arptimer()) was currently executing on another CPU and we proceeded to free the llentry via LLE_FREE_LOCKED(), causing use-after-free when the timer callback subsequently accessed the freed memory. Sent a candidate PR here for review: https://github.com/freebsd/freebsd-src/pull/2219 -- You are receiving this mail because: You are the assignee for the bug.
