igmp: fix igmp proxy group merge

When merging proxy groups in igmp_proxy_device_merge_group(), the call
to igmp_proxy_device_merge_src() can end up removing the current proxy
group via igmp_group_clear(). When that happens, it must returns NULL so
that igmp_proxy_device_merge_config() does not send a IGMPv3 report for
a dead proxy group.
Make igmp_group_clear() reset the group pointer to NULL to fix this bug
and to detect similar bugs more easily.

Type: fix

Change-Id: I229e55b5bfa71734d7844893f5209a66fa3cc8ae
Signed-off-by: Benoît Ganne <bganne@cisco.com>

1 files changed, 11 insertions, 10 deletions

diff --git a/src/plugins/igmp/igmp_group.c b/src/plugins/igmp/igmp_group.c
index 51a44d2dfd5..eec4c9b8f81 100644
--- a/src/plugins/igmp/igmp_group.c
+++ b/src/plugins/igmp/igmp_group.c
@@ -65,38 +65,39 @@ igmp_group_src_update (igmp_group_t * group,
 }
 
 void
-igmp_group_clear (igmp_group_t * group)
+igmp_group_clear (igmp_group_t ** group)
 {
   igmp_config_t *config;
   u32 ii;
 
-  ASSERT (group);
+  ASSERT (*group);
 
-  config = igmp_config_get (group->config);
+  config = igmp_config_get ((*group)->config);
 
   /* If interface is in ROUTER mode and IGMP proxy is enabled
    * remove mfib path.
    */
   if (config->mode == IGMP_MODE_ROUTER)
     {
-      igmp_proxy_device_mfib_path_add_del (group, /* add */ 0);
+      igmp_proxy_device_mfib_path_add_del (*group, /* add */ 0);
     }
 
   IGMP_DBG ("clear-group: %U %U",
-	    format_igmp_key, group->key,
+	    format_igmp_key, (*group)->key,
 	    format_vnet_sw_if_index_name,
 	    vnet_get_main (), config->sw_if_index);
 
-  igmp_group_free_all_srcs (group);
+  igmp_group_free_all_srcs (*group);
 
   for (ii = 0; ii < IGMP_GROUP_N_TIMERS; ii++)
     {
-      igmp_timer_retire (&group->timers[ii]);
+      igmp_timer_retire (&(*group)->timers[ii]);
     }
 
-  hash_unset_mem (config->igmp_group_by_key, group->key);
-  clib_mem_free (group->key);
-  pool_put (igmp_main.groups, group);
+  hash_unset_mem (config->igmp_group_by_key, (*group)->key);
+  clib_mem_free ((*group)->key);
+  pool_put (igmp_main.groups, *group);
+  *group = 0;
 }
 
 igmp_group_t *