Date: Mon, 7 Sep 2009 16:00:33 +0000 (UTC) From: Shteryana Shopova <syrinx@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r196932 - head/sys/netinet Message-ID: <200909071600.n87G0XdT019506@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: syrinx Date: Mon Sep 7 16:00:33 2009 New Revision: 196932 URL: http://svn.freebsd.org/changeset/base/196932 Log: When joining a multicast group, the inp_lookup_mcast_ifp call does a KASSERT that the group address is multicast, so the check if this is indeed true and eventually return a EINVAL if not, should be done before calling inp_lookup_mcast_ifp. This fixes a kernel crash when calling setsockopt (sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,...) with invalid group address. Reviewed by: bms Approved by: bms MFC after: 3 days Modified: head/sys/netinet/in_mcast.c Modified: head/sys/netinet/in_mcast.c ============================================================================== --- head/sys/netinet/in_mcast.c Mon Sep 7 15:52:15 2009 (r196931) +++ head/sys/netinet/in_mcast.c Mon Sep 7 16:00:33 2009 (r196932) @@ -1899,6 +1899,9 @@ inp_join_group(struct inpcb *inp, struct ssa->sin.sin_addr = mreqs.imr_sourceaddr; } + if (!IN_MULTICAST(ntohl(gsa->sin.sin_addr.s_addr))) + return (EINVAL); + ifp = inp_lookup_mcast_ifp(inp, &gsa->sin, mreqs.imr_interface); CTR3(KTR_IGMPV3, "%s: imr_interface = %s, ifp = %p", @@ -1936,6 +1939,9 @@ inp_join_group(struct inpcb *inp, struct ssa->sin.sin_port = 0; } + if (!IN_MULTICAST(ntohl(gsa->sin.sin_addr.s_addr))) + return (EINVAL); + if (gsr.gsr_interface == 0 || V_if_index < gsr.gsr_interface) return (EADDRNOTAVAIL); ifp = ifnet_byindex(gsr.gsr_interface); @@ -1948,9 +1954,6 @@ inp_join_group(struct inpcb *inp, struct break; } - if (!IN_MULTICAST(ntohl(gsa->sin.sin_addr.s_addr))) - return (EINVAL); - if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) return (EADDRNOTAVAIL);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200909071600.n87G0XdT019506>