svn commit: r337866 - in head/sys: net netinet netinet6

[Mark Johnston]

On Tue, Aug 21, 2018 at 04:00:10PM -0700, Matthew Macy wrote:
> Yes. See r338162. Thanks.

You missed instances of the same bug in in_mcast.c and in6_mcast.c.

> On Tue, Aug 21, 2018 at 2:24 PM Gleb Smirnoff <glebius at freebsd.org> wrote:
> > On Wed, Aug 15, 2018 at 08:23:09PM +0000, Matt Macy wrote:
> > M> @@ -3772,8 +3775,11 @@ if_delmulti_locked(struct ifnet *ifp, struct
> > ifmultiad
> > M>                      ll_ifma->ifma_ifp = NULL;       /* XXX */
> > M>              if (--ll_ifma->ifma_refcount == 0) {
> > M>                      if (ifp != NULL) {
> > M> -                            CK_STAILQ_REMOVE(&ifp->if_multiaddrs,
> > ll_ifma, ifmultiaddr,
> > M> -                                ifma_link);
> > M> +                            if (ll_ifma->ifma_flags & IFMA_F_ENQUEUED)
> > {
> > M> +
> > CK_STAILQ_REMOVE(&ifp->if_multiaddrs, ll_ifma, ifmultiaddr,
> > M> +                                            ifma_link);
> > M> +                                    ifma->ifma_flags &=
> > ~IFMA_F_ENQUEUED;
> > M> +                            }
> > M>                      }
> > M>                      if_freemulti(ll_ifma);
> > M>              }
> >
> > Coverity suggested there is a cut and paste mistake here, and it is
> > compilable.
> > After quick glance I tend to agree. Looks like flag is cleared on wrong
> > ifma.
> >
> > --
> > Gleb Smirnoff
> >