From bd7f3422bbe38ba87888b765e94b56bfcbb9602c Mon Sep 17 00:00:00 2001 From: Benoît Ganne Date: Thu, 16 Apr 2020 12:47:47 +0200 Subject: igmp: fix igmp proxy group merge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When merging proxy groups in igmp_proxy_device_merge_group(), the call to igmp_proxy_device_merge_src() can end up removing the current proxy group via igmp_group_clear(). When that happens, it must returns NULL so that igmp_proxy_device_merge_config() does not send a IGMPv3 report for a dead proxy group. Make igmp_group_clear() reset the group pointer to NULL to fix this bug and to detect similar bugs more easily. Type: fix Change-Id: I229e55b5bfa71734d7844893f5209a66fa3cc8ae Signed-off-by: Benoît Ganne --- src/plugins/igmp/igmp_group.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) (limited to 'src/plugins/igmp/igmp_group.c') diff --git a/src/plugins/igmp/igmp_group.c b/src/plugins/igmp/igmp_group.c index 51a44d2dfd5..eec4c9b8f81 100644 --- a/src/plugins/igmp/igmp_group.c +++ b/src/plugins/igmp/igmp_group.c @@ -65,38 +65,39 @@ igmp_group_src_update (igmp_group_t * group, } void -igmp_group_clear (igmp_group_t * group) +igmp_group_clear (igmp_group_t ** group) { igmp_config_t *config; u32 ii; - ASSERT (group); + ASSERT (*group); - config = igmp_config_get (group->config); + config = igmp_config_get ((*group)->config); /* If interface is in ROUTER mode and IGMP proxy is enabled * remove mfib path. */ if (config->mode == IGMP_MODE_ROUTER) { - igmp_proxy_device_mfib_path_add_del (group, /* add */ 0); + igmp_proxy_device_mfib_path_add_del (*group, /* add */ 0); } IGMP_DBG ("clear-group: %U %U", - format_igmp_key, group->key, + format_igmp_key, (*group)->key, format_vnet_sw_if_index_name, vnet_get_main (), config->sw_if_index); - igmp_group_free_all_srcs (group); + igmp_group_free_all_srcs (*group); for (ii = 0; ii < IGMP_GROUP_N_TIMERS; ii++) { - igmp_timer_retire (&group->timers[ii]); + igmp_timer_retire (&(*group)->timers[ii]); } - hash_unset_mem (config->igmp_group_by_key, group->key); - clib_mem_free (group->key); - pool_put (igmp_main.groups, group); + hash_unset_mem (config->igmp_group_by_key, (*group)->key); + clib_mem_free ((*group)->key); + pool_put (igmp_main.groups, *group); + *group = 0; } igmp_group_t * -- cgit 1.2.3-korg