svn commit: r333462 - head/sys/netinet6

[Andrew Gallatin]

Author: gallatin
Date: Thu May 10 16:19:41 2018
New Revision: 333462
URL: https://svnweb.freebsd.org/changeset/base/333462

Log:
  Fix a panic in the IPv6 multicast code.
  
  Use LIST_FOREACH_SAFE in in6m_disconnect() since we're
  deleting and freeing item from the membership list
  while traversing the list.
  
  Reviewed by:	mmacy
  Sponsored by:	Netflix

Modified:
  head/sys/netinet6/in6_mcast.c

Modified: head/sys/netinet6/in6_mcast.c
==============================================================================
--- head/sys/netinet6/in6_mcast.c	Thu May 10 15:01:43 2018	(r333461)
+++ head/sys/netinet6/in6_mcast.c	Thu May 10 16:19:41 2018	(r333462)
@@ -581,7 +581,7 @@ in6m_disconnect(struct in6_multi *inm)
 	struct ifnet *ifp;
 	struct ifaddr *ifa;
 	struct in6_ifaddr *ifa6;
-	struct in6_multi_mship *imm;
+	struct in6_multi_mship *imm, *imm_tmp;
 	struct ifmultiaddr *ifma, *ll_ifma;
 
 	ifp = inm->in6m_ifp;
@@ -607,7 +607,8 @@ in6m_disconnect(struct in6_multi *inm)
 		if (ifa->ifa_addr->sa_family != AF_INET6)
 			continue;
 		ifa6 = (void *)ifa;
-		LIST_FOREACH(imm, &ifa6->ia6_memberships, i6mm_chain) {
+		LIST_FOREACH_SAFE(imm, &ifa6->ia6_memberships,
+		    i6mm_chain, imm_tmp) {
 			if (inm == imm->i6mm_maddr) {
 				LIST_REMOVE(imm, i6mm_chain);
 				free(imm, M_IP6MADDR);