From d51cecd143c5dae385fe7fcfcac42e53ff3b4f42 Mon Sep 17 00:00:00 2001 From: Shteryana Shopova Date: Fri, 11 Sep 2009 15:07:36 +0000 Subject: [PATCH] MFC r196932: When joining a multicast group, the inp_lookup_mcast_ifp call does a KASSERT that the group address is multicast, so the check if this is indeed true and eventually return a EINVAL if not, should be done before calling inp_lookup_mcast_ifp. This fixes a kernel crash when calling setsockopt (sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,...) with invalid group address. Reviewed by: bms Approved by: re (kib) --- sys/netinet/in_mcast.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/sys/netinet/in_mcast.c b/sys/netinet/in_mcast.c index d0e139751e9..9a828210cc6 100644 --- a/sys/netinet/in_mcast.c +++ b/sys/netinet/in_mcast.c @@ -1899,6 +1899,9 @@ inp_join_group(struct inpcb *inp, struct sockopt *sopt) ssa->sin.sin_addr = mreqs.imr_sourceaddr; } + if (!IN_MULTICAST(ntohl(gsa->sin.sin_addr.s_addr))) + return (EINVAL); + ifp = inp_lookup_mcast_ifp(inp, &gsa->sin, mreqs.imr_interface); CTR3(KTR_IGMPV3, "%s: imr_interface = %s, ifp = %p", @@ -1936,6 +1939,9 @@ inp_join_group(struct inpcb *inp, struct sockopt *sopt) ssa->sin.sin_port = 0; } + if (!IN_MULTICAST(ntohl(gsa->sin.sin_addr.s_addr))) + return (EINVAL); + if (gsr.gsr_interface == 0 || V_if_index < gsr.gsr_interface) return (EADDRNOTAVAIL); ifp = ifnet_byindex(gsr.gsr_interface); @@ -1948,9 +1954,6 @@ inp_join_group(struct inpcb *inp, struct sockopt *sopt) break; } - if (!IN_MULTICAST(ntohl(gsa->sin.sin_addr.s_addr))) - return (EINVAL); - if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) return (EADDRNOTAVAIL);