Kernel crash on nd6_dad_timer

[steven_chen3_dell.com]

Summary

after nd6_dad_start is called, but before nd6_dad_timer run, if system start sleep, which will trigger nd6_dad_stop run, then before system suspend, nd6_dad_timer run, then kernel will access the freed memory.

Test Plan

sleep,resume test, after 600+ times

[ae]

sys/netinet6/nd6_nbr.c

1257

This also looks like access after free.

[steven_chen3_dell.com]

change the parameter of nd6_dad_timer to ifa, then before run, find dp by ifa.

[steven_chen3_dell.com]

sys/netinet6/nd6_nbr.c

1257

Yes, you are right, thank you! I am too careless. I have updated my diff now.