Do not clean the multicast records of an interface when it is destroyed

(unplugged).  Even if it makes no sense to keep them around if the
interface is no more, we cannot safely remove them since pcb multicast
options might keep a pointer to them.

Fixes a user after free introduced by the multicast address linking
rewrite and reported by Alexey Suslikov, thanks!

ok claudio@

5 files changed, 31 insertions, 35 deletions

diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c
index 2a4976c74fd..d4a60b432df 100644
--- a/sys/netinet6/in6.c
+++ b/sys/netinet6/in6.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in6.c,v 1.129 2014/01/15 09:25:38 mpi Exp $	*/
+/*	$OpenBSD: in6.c,v 1.130 2014/01/21 10:18:26 mpi Exp $	*/
 /*	$KAME: in6.c,v 1.372 2004/06/14 08:14:21 itojun Exp $	*/
 
 /*
@@ -1592,7 +1592,7 @@ in6_addmulti(struct in6_addr *maddr6, struct ifnet *ifp, int *errorp)
 		in6m->in6m_sin.sin6_family = AF_INET6;
 		in6m->in6m_sin.sin6_addr = *maddr6;
 		in6m->in6m_refcnt = 1;
-		in6m->in6m_ifp = ifp;
+		in6m->in6m_ifidx = ifp->if_index;
 		in6m->in6m_ifma.ifma_addr = sin6tosa(&in6m->in6m_sin);
 
 		/*
@@ -1637,21 +1637,24 @@ in6_delmulti(struct in6_multi *in6m)
 		 * that we are leaving the multicast group.
 		 */
 		mld6_stop_listening(in6m);
-		ifp = in6m->in6m_ifp;
+		ifp = if_get(in6m->in6m_ifidx);
 
 		/*
 		 * Notify the network driver to update its multicast
 		 * reception filter.
 		 */
-		bzero(&ifr.ifr_addr, sizeof(struct sockaddr_in6));
-		ifr.ifr_addr.sin6_len = sizeof(struct sockaddr_in6);
-		ifr.ifr_addr.sin6_family = AF_INET6;
-		ifr.ifr_addr.sin6_addr = in6m->in6m_addr;
-		(*ifp->if_ioctl)(in6m->in6m_ifp, SIOCDELMULTI, (caddr_t)&ifr);
-
-		s = splsoftnet();
-		TAILQ_REMOVE(&ifp->if_maddrlist, &in6m->in6m_ifma, ifma_list);
-		splx(s);
+		if (ifp != NULL) {
+			bzero(&ifr.ifr_addr, sizeof(struct sockaddr_in6));
+			ifr.ifr_addr.sin6_len = sizeof(struct sockaddr_in6);
+			ifr.ifr_addr.sin6_family = AF_INET6;
+			ifr.ifr_addr.sin6_addr = in6m->in6m_addr;
+			(*ifp->if_ioctl)(ifp, SIOCDELMULTI, (caddr_t)&ifr);
+
+			s = splsoftnet();
+			TAILQ_REMOVE(&ifp->if_maddrlist, &in6m->in6m_ifma,
+			    ifma_list);
+			splx(s);
+		}
 
 		free(in6m, M_IPMADDR);
 	}
diff --git a/sys/netinet6/in6_ifattach.c b/sys/netinet6/in6_ifattach.c
index 567caa0b219..f1757337b6f 100644
--- a/sys/netinet6/in6_ifattach.c
+++ b/sys/netinet6/in6_ifattach.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in6_ifattach.c,v 1.67 2014/01/13 23:03:52 bluhm Exp $	*/
+/*	$OpenBSD: in6_ifattach.c,v 1.68 2014/01/21 10:18:26 mpi Exp $	*/
 /*	$KAME: in6_ifattach.c,v 1.124 2001/07/18 08:32:51 jinmei Exp $	*/
 
 /*
@@ -646,7 +646,6 @@ void
 in6_ifdetach(struct ifnet *ifp)
 {
 	struct ifaddr *ifa, *next;
-	struct ifmaddr *ifma, *mnext;
 	struct rtentry *rt;
 	struct sockaddr_in6 sin6;
 
@@ -665,15 +664,6 @@ in6_ifdetach(struct ifnet *ifp)
 		in6_purgeaddr(ifa);
 	}
 
-
-	TAILQ_FOREACH_SAFE(ifma, &ifp->if_maddrlist, ifma_list, mnext) {
-		if (ifma->ifma_addr->sa_family != AF_INET6)
-			continue;
-
-		ifma->ifma_refcnt = 1;
-		in6_delmulti(ifmatoin6m(ifma));
-	}
-
 	/*
 	 * remove neighbor management table.  we call it twice just to make
 	 * sure we nuke everything.  maybe we need just one call.
diff --git a/sys/netinet6/in6_var.h b/sys/netinet6/in6_var.h
index 4b504494a20..56eef418e44 100644
--- a/sys/netinet6/in6_var.h
+++ b/sys/netinet6/in6_var.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in6_var.h,v 1.46 2013/11/28 10:16:44 mpi Exp $	*/
+/*	$OpenBSD: in6_var.h,v 1.47 2014/01/21 10:18:26 mpi Exp $	*/
 /*	$KAME: in6_var.h,v 1.55 2001/02/16 12:49:45 itojun Exp $	*/
 
 /*
@@ -467,7 +467,7 @@ struct in6_multi_mship {
 struct in6_multi {
 	struct ifmaddr		in6m_ifma;   /* Protocol-independent info */
 #define in6m_refcnt		in6m_ifma.ifma_refcnt
-#define in6m_ifp		in6m_ifma.ifma_ifp
+#define in6m_ifidx		in6m_ifma.ifma_ifidx
 
 	struct sockaddr_in6	in6m_sin;   /* IPv6 multicast address */
 #define in6m_addr		in6m_sin.sin6_addr
diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index b2f11f617fb..f547e635db8 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip6_output.c,v 1.149 2014/01/13 23:03:52 bluhm Exp $	*/
+/*	$OpenBSD: ip6_output.c,v 1.150 2014/01/21 10:18:26 mpi Exp $	*/
 /*	$KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $	*/
 
 /*
@@ -2514,7 +2514,7 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 		 * See if the membership already exists.
 		 */
 		LIST_FOREACH(imm, &im6o->im6o_memberships, i6mm_chain)
-			if (imm->i6mm_maddr->in6m_ifp == ifp &&
+			if (imm->i6mm_maddr->in6m_ifidx == ifp->if_index &&
 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
 			    &mreq->ipv6mr_multiaddr))
 				break;
@@ -2578,7 +2578,8 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 		 * Find the membership in the membership list.
 		 */
 		LIST_FOREACH(imm, &im6o->im6o_memberships, i6mm_chain) {
-			if ((ifp == NULL || imm->i6mm_maddr->in6m_ifp == ifp) &&
+			if ((ifp == NULL ||
+			    imm->i6mm_maddr->in6m_ifidx == ifp->if_index) &&
 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
 			    &mreq->ipv6mr_multiaddr))
 				break;
diff --git a/sys/netinet6/mld6.c b/sys/netinet6/mld6.c
index 95648c14080..d0058336823 100644
--- a/sys/netinet6/mld6.c
+++ b/sys/netinet6/mld6.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mld6.c,v 1.35 2014/01/13 23:03:52 bluhm Exp $	*/
+/*	$OpenBSD: mld6.c,v 1.36 2014/01/21 10:18:26 mpi Exp $	*/
 /*	$KAME: mld6.c,v 1.26 2001/02/16 14:50:35 itojun Exp $	*/
 
 /*
@@ -127,8 +127,7 @@ mld6_start_listening(struct in6_multi *in6m)
 	 * MLD messages are never sent for multicast addresses whose scope is 0
 	 * (reserved) or 1 (node-local).
 	 */
-	mld_all_nodes_linklocal.s6_addr16[1] =
-	    htons(in6m->in6m_ifp->if_index); /* XXX */
+	mld_all_nodes_linklocal.s6_addr16[1] = htons(in6m->in6m_ifidx);/* XXX */
 	if (IN6_ARE_ADDR_EQUAL(&in6m->in6m_addr, &mld_all_nodes_linklocal) ||
 	    __IPV6_ADDR_MC_SCOPE(&in6m->in6m_addr) < __IPV6_ADDR_SCOPE_LINKLOCAL) {
 		in6m->in6m_timer = 0;
@@ -149,10 +148,9 @@ mld6_stop_listening(struct in6_multi *in6m)
 {
 	int s = splsoftnet();
 
-	mld_all_nodes_linklocal.s6_addr16[1] =
-	    htons(in6m->in6m_ifp->if_index); /* XXX */
+	mld_all_nodes_linklocal.s6_addr16[1] = htons(in6m->in6m_ifidx);/* XXX */
 	mld_all_routers_linklocal.s6_addr16[1] =
-	    htons(in6m->in6m_ifp->if_index); /* XXX: necessary when mrouting */
+	    htons(in6m->in6m_ifidx); /* XXX: necessary when mrouting */
 
 	if (in6m->in6m_state == MLD_IREPORTEDLAST &&
 	    (!IN6_ARE_ADDR_EQUAL(&in6m->in6m_addr, &mld_all_nodes_linklocal)) &&
@@ -374,9 +372,13 @@ mld6_sendpkt(struct in6_multi *in6m, int type, const struct in6_addr *dst)
 	struct ip6_hdr *ip6;
 	struct ip6_moptions im6o;
 	struct in6_ifaddr *ia6;
-	struct ifnet *ifp = in6m->in6m_ifp;
+	struct ifnet *ifp;
 	int ignflags;
 
+	ifp = if_get(in6m->in6m_ifidx);
+	if (ifp == NULL)
+		return;
+
 	/*
 	 * At first, find a link local address on the outgoing interface
 	 * to use as the source address of the MLD packet.