[Bug 233535] Fix refcount leak in IPv6 MLD code leading to loss of IPv6 connectivity

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=233535

--- Comment #52 from commit-hook at freebsd.org ---
A commit references this bug:

Author: hselasky
Date: Thu Jan 24 08:34:14 UTC 2019
New revision: 343395
URL: https://svnweb.freebsd.org/changeset/base/343395

Log:
  Fix refcounting leaks in IPv6 MLD code leading to loss of IPv6
  connectivity.

  Looking at past changes in this area like r337866, some refcounting
  bugs have been introduced, one by one. For example like calling
  in6m_disconnect() and in6m_rele_locked() in mld_v1_process_group_timer()
  where previously no disconnect nor refcount decrement was done.
  Calling in6m_disconnect() when it shouldn't causes IPv6 solitation to no
  longer work, because all the multicast addresses receiving the solitation
  messages are now deleted from the network interface.

  This patch reverts some recent changes while improving the MLD
  refcounting and concurrency model after the MLD code was converted
  to using EPOCH(9).

  List changes:
  - All CK_STAILQ_FOREACH() macros are now properly enclosed into
    EPOCH(9) sections. This simplifies assertion of locking inside
    in6m_ifmultiaddr_get_inm().
  - Corrected bad use of in6m_disconnect() leading to loss of IPv6
    connectivity for MLD v1.
  - Factored out checks for valid inm structure into
    in6m_ifmultiaddr_get_inm().

  PR:                   233535
  Differential Revision:        https://reviews.freebsd.org/D18887
  Reviewed by:          bz (net)
  Tested by:            ae
  MFC after:            1 week
  Sponsored by:         Mellanox Technologies

Changes:
  head/sys/netinet6/in6_ifattach.c
  head/sys/netinet6/in6_mcast.c
  head/sys/netinet6/in6_var.h
  head/sys/netinet6/mld6.c
  head/sys/netinet6/mld6_var.h

-- 
You are receiving this mail because:
You are on the CC list for the bug.