CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/16 00:18:35
Modified files:
sys/net : if.c
sys/netinet : in.c
sys/netinet6 : in6_ifattach.c
Log message:
Unlink multicast records when their interface is detached
Nothing dropped ifp->if_maddrlist at detach, so a socket that had
joined a group left its struct in_multi/in6_multi linked into the
ifnet that if_detach() then freed, holding a bare if_index. When the
socket finally dropped the membership, in_delmulti() resolved that
index; once if_idxmap_alloc() had wrapped the 16-bit space and handed
it to another interface, the TAILQ_REMOVE wrote through a tqe_prev
pointing into the freed ifnet and left the innocent interface tqh_last
pointing there too.
Unlink the records in in_ifdetach() and in6_ifdetach() and clear the
index; the sockets still reference them, so they are freed as before
when the last one goes away.
OK claudio@
Reported-by: [email protected]
Reported-by: [email protected]
Reported-by: [email protected]
