Take the ifnet's address lock in igmp_v3_cancel_link_timers().

[markj]

Summary

inm_rele_locked() may remove the multicast address associated with inm.

Reported by: [e-mail]

Test Plan

I don't have a test for it yet, syzkaller did not generate a reproducer.

[markj]

Also note that this change is consistent with mld_v2_cancel_link_timers().

[• hselasky]

Looks good.

And add to the commit message that inm_disconnect() asserts the IF_ADDR_WLOCK() .

You might want to move this assert one level up and into: inm_rele_locked() ....

Then you see there is also a call at line 1891, which needs IF_ADDR_WLOCK() around it.

Might be better to only lock when inm_refcount == 0.

[markj]

In D23009#504106, @hselasky wrote:

Looks good.

And add to the commit message that inm_disconnect() asserts the IF_ADDR_WLOCK() .

You might want to move this assert one level up and into: inm_rele_locked() ....

That assertion would be wrong for the call in igmp_initial_join(), where the refcount is > 1.

Then you see there is also a call at line 1891, which needs IF_ADDR_WLOCK() around it.

The caller, igmp_fasttimo_vnet(), already takes the addr wlock.

Might be better to only lock when inm_refcount == 0.

[• hselasky]

OK.