svn commit: r337866 - in head/sys: net netinet netinet6

[Matthew Macy]

On Tue, Aug 21, 2018 at 16:52 Mark Johnston <markj at freebsd.org> wrote:

> On Tue, Aug 21, 2018 at 04:00:10PM -0700, Matthew Macy wrote:
> > Yes. See r338162. Thanks.
>
> You missed instances of the same bug in in_mcast.c and in6_mcast.c.



Thanks

>
>
> > On Tue, Aug 21, 2018 at 2:24 PM Gleb Smirnoff <glebius at freebsd.org>
> wrote:
> > > On Wed, Aug 15, 2018 at 08:23:09PM +0000, Matt Macy wrote:
> > > M> @@ -3772,8 +3775,11 @@ if_delmulti_locked(struct ifnet *ifp, struct
> > > ifmultiad
> > > M>                      ll_ifma->ifma_ifp = NULL;       /* XXX */
> > > M>              if (--ll_ifma->ifma_refcount == 0) {
> > > M>                      if (ifp != NULL) {
> > > M> -                            CK_STAILQ_REMOVE(&ifp->if_multiaddrs,
> > > ll_ifma, ifmultiaddr,
> > > M> -                                ifma_link);
> > > M> +                            if (ll_ifma->ifma_flags &
> IFMA_F_ENQUEUED)
> > > {
> > > M> +
> > > CK_STAILQ_REMOVE(&ifp->if_multiaddrs, ll_ifma, ifmultiaddr,
> > > M> +                                            ifma_link);
> > > M> +                                    ifma->ifma_flags &=
> > > ~IFMA_F_ENQUEUED;
> > > M> +                            }
> > > M>                      }
> > > M>                      if_freemulti(ll_ifma);
> > > M>              }
> > >
> > > Coverity suggested there is a cut and paste mistake here, and it is
> > > compilable.
> > > After quick glance I tend to agree. Looks like flag is cleared on wrong
> > > ifma.
> > >
> > > --
> > > Gleb Smirnoff
> > >
>