diff options
| author | Martin Pieuchot <mpi@cvs.openbsd.org> | 2014-01-21 10:18:27 +0000 |
|---|---|---|
| committer | Martin Pieuchot <mpi@cvs.openbsd.org> | 2014-01-21 10:18:27 +0000 |
| commit | afabf447e8168a34694f0eca272e80e7fc416c39 (patch) | |
| tree | b6d289ad055b7220f002e24aa0db83837cc1354d /sys/netinet/ip_output.c | |
| parent | 492bb95e09ccd5e49a21417ea42f9dd979a37939 (diff) | |
Do not clean the multicast records of an interface when it is destroyed
(unplugged). Even if it makes no sense to keep them around if the
interface is no more, we cannot safely remove them since pcb multicast
options might keep a pointer to them.
Fixes a user after free introduced by the multicast address linking
rewrite and reported by Alexey Suslikov, thanks!
ok claudio@
Diffstat (limited to 'sys/netinet/ip_output.c')
| -rw-r--r-- | sys/netinet/ip_output.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index 1c1c0b534a7..ffd49ec9ba5 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_output.c,v 1.254 2014/01/09 06:29:06 tedu Exp $ */ +/* $OpenBSD: ip_output.c,v 1.255 2014/01/21 10:18:26 mpi Exp $ */ /* $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $ */ /* @@ -1833,7 +1833,8 @@ ip_setmoptions(int optname, struct ip_moptions **imop, struct mbuf *m, * membership slots are full. */ for (i = 0; i < imo->imo_num_memberships; ++i) { - if (imo->imo_membership[i]->inm_ifp == ifp && + if (imo->imo_membership[i]->inm_ifidx + == ifp->if_index && imo->imo_membership[i]->inm_addr.s_addr == mreq->imr_multiaddr.s_addr) break; @@ -1916,7 +1917,8 @@ ip_setmoptions(int optname, struct ip_moptions **imop, struct mbuf *m, */ for (i = 0; i < imo->imo_num_memberships; ++i) { if ((ifp == NULL || - imo->imo_membership[i]->inm_ifp == ifp) && + imo->imo_membership[i]->inm_ifidx == + ifp->if_index) && imo->imo_membership[i]->inm_addr.s_addr == mreq->imr_multiaddr.s_addr) break; |