When leaving a multicast group, inp_leave_group() creates a hole in the
source filter and group membership arrays. It copies succeeding
elements down by 1 entry, so the last entry remains initialized with
stale data. This can trip an assertion in inp_join_group() which
verifies that the newly allocated source filter array entry does not
contain any source filters. Fix the problem by explicitly
reinitializing the last source filter array entry using the same
measures as in imo_grow().
Details
Details
- Reviewers
ae - Group Reviewers
network - Commits
- rS346118: Reinitialize multicast source filter structures after invalidation.
The diff fixes this report from syzkaller:
https://syzkaller.appspot.com/bug?id=f5ead1657644d18c765fb186f26e0476bc9fc63c
Diff Detail
Diff Detail
- Repository
- rS FreeBSD src repository - subversion
- Lint
Lint Not Applicable - Unit
Tests Not Applicable