kern/77665: multicast sockets + interface removal = panic

[Brooks Davis]

>Number:         77665
>Category:       kern
>Synopsis:       multicast sockets + interface removal = panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Feb 18 06:30:24 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Brooks Davis
>Release:        FreeBSD 6.0-CURRENT i386
>Organization:
>Environment:
System: FreeBSD minya 6.0-CURRENT FreeBSD 6.0-CURRENT #13: Wed Feb  9 14:33:45 EST 2005     brooks at minya:/home/brooks/working/freebsd/p4/cleanup/sys/i386/compile/MINYA  i386


	
>Description:

Creating a multicast socket, such as those created by the
net/mDNSResponder port, and then removing an interface that is up will
cause a panic in if_delmulti().  The stack is roughly:

if_delmulti()+0xc
in_delmulti()+0x6a
ip_freemoptions()+0x21
in_pcpdetach()+0x168
udp_detach()+0x65
soclose()+0x1e0
soo_close()+0x4b
fdrop_locked()+0x88
fdrop()+0x24
closef()+0x367
close()+0x1a3
syscall()+0x213

>How-To-Repeat:

Configure a removable interface (ath0 in my case), install and run
net/mDNSResponder, and eject the card.

>Fix:

If the interface is down when ejected, the panic does no occure.

>Release-Note:
>Audit-Trail:
>Unformatted: