Comment 2 for bug 710371

With the upstream kernel build linux-image-2.6.38-999-generic version 2.6.38-999.201101281114 I get what looks to be the same oops:

[ 307.861225] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 307.865272] IP: [< (null)>] (null)
[ 307.868654] PGD 0
[ 307.871146] Oops: 0010 [#1] SMP
[ 307.873642] last sysfs file: /sys/devices/LNXSYSTM:00/device:00/PNP0A08:00/device:0b/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/voltage_now
[ 307.876302] CPU 0
[ 307.876329] Modules linked in: hidp hid ip6table_filter deflate zlib_deflate ip6_tables ctr twofish_generic twofish_x86_64 twofish_common camellia serpent blowfish cast5 des_generic aesni_intel cryptd aes_x86_64 aes_generic xcbc rmd160 xt_CHECKSUM iptable_mangle sha512_generic binfmt_misc ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack sha256_generic ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge sha1_generic stp crypto_null af_key joydev parport_pc dm_crypt ppdev snd_hda_codec_hdmi rfcomm snd_hda_codec_conexant arc4 sco bnep thinkpad_acpi l2cap iwlagn snd_hda_intel snd_hda_codec snd_hwdep snd_pcm iwlcore uvcvideo snd_seq_midi snd_rawmidi mac80211 snd_seq_midi_event videodev v4l2_compat_ioctl32 btusb snd_seq bluetooth cfg80211 snd_timer snd_seq_device psmouse serio_raw snd snd_page_alloc intel_ips soundcore nvram tpm_tis tpm tpm_bios lp parport i915 drm_kms_helper e1000e drm ahci libahci i2c_algo_bit video
[ 307.898289]
[ 307.901550] Pid: 3140, comm: ssh Not tainted 2.6.38-999-generic #201101281114 2901CTO/2901CTO
[ 307.904894] RIP: 0010:[<0000000000000000>] [< (null)>] (null)
[ 307.908301] RSP: 0018:ffff880231b13ad0 EFLAGS: 00010246
[ 307.911679] RAX: ffffffff81a643c0 RBX: 0000000000000000 RCX: ffff88023105b180
[ 307.915069] RDX: ffff88023105b180 RSI: ffffffff814e5a50 RDI: ffff88023105b180
[ 307.918484] RBP: ffff880231b13b88 R08: 0000000000000008 R09: ffff880231b13be8
[ 307.921901] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000008
[ 307.925304] R13: 0000000000000000 R14: ffff880231b13e58 R15: ffff88022fe223c0
[ 307.928756] FS: 00007fd52fccc7e0(0000) GS:ffff8800bb000000(0000) knlGS:0000000000000000
[ 307.932232] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 307.935709] CR2: 0000000000000000 CR3: 0000000204452000 CR4: 00000000000006f0
[ 307.939253] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 307.942752] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 307.946109] Process ssh (pid: 3140, threadinfo ffff880231b12000, task ffff88022dda5b00)
[ 307.949520] Stack:
[ 307.952869] ffffffff814e6347 ffff880231b13af8 0000000000000246 ffff88022fe224c8
[ 307.956302] ffff880231b13be8 0000003d31b13b18 ffff880231b13e98 ffffffff814e5a50
[ 307.959728] ffff88023105be00 ffff880231b13b48 ffffffff814defc3 ffff880231b13c08
[ 307.963144] Call Trace:
[ 307.966528] [<ffffffff814e6347>] ? ip_append_data+0x787/0xab0
[ 307.969967] [<ffffffff814e5a50>] ? ip_generic_getfrag+0x0/0xa0
[ 307.973414] [<ffffffff814defc3>] ? ipv4_dst_blackhole+0x1c3/0x210
[ 307.976864] [<ffffffff815a115e>] ? _raw_spin_lock_bh+0x1e/0x30
[ 307.980287] [<ffffffff8150bd09>] udp_sendmsg+0x389/0x790
[ 307.983732] [<ffffffff815143d9>] inet_sendmsg+0x69/0xc0
[ 307.987138] [<ffffffff8149cb3a>] sock_sendmsg+0x10a/0x120
[ 307.990552] [<ffffffff8107e663>] ? queue_delayed_work_on+0xb3/0x110
[ 307.994033] [<ffffffff815a1099>] ? _raw_spin_unlock_bh+0x19/0x20
[ 307.997455] [<ffffffff814b8260>] ? __dst_free+0x50/0xa0
[ 308.000868] [<ffffffff815a1099>] ? _raw_spin_unlock_bh+0x19/0x20
[ 308.004274] [<ffffffff8150adcb>] ? udp_lib_rehash+0x11b/0x140
[ 308.007675] [<ffffffff8150b2ef>] ? udp_v4_rehash+0x2f/0x40
[ 308.011108] [<ffffffff8149adaa>] ? sockfd_lookup_light+0x4a/0x80
[ 308.014548] [<ffffffff8149d75a>] sys_sendto+0x13a/0x190
[ 308.017982] [<ffffffff815a0e0e>] ? _raw_spin_lock+0xe/0x20
[ 308.021395] [<ffffffff81156c30>] ? fd_install+0x60/0x70
[ 308.024770] [<ffffffff8100c002>] system_call_fastpath+0x16/0x1b
[ 308.028141] Code: Bad RIP value.
[ 308.031547] RIP [< (null)>] (null)
[ 308.034952] RSP <ffff880231b13ad0>
[ 308.038330] CR2: 0000000000000000
[ 308.041823] ---[ end trace 12c863de1da69f98 ]---

so this looks to be both easily reproducible and present upstream.