Commit 52ad353a authored Jul 02, 2014 by dingtianhong Committed by David S. Miller Jul 07, 2014

igmp: fix the problem when mc leave group

The problem was triggered by these steps:

1) create socket, bind and then setsockopt for add mc group.
mreq.imr_multiaddr.s_addr = inet_addr("255.0.0.37");
mreq.imr_interface.s_addr = inet_addr("192.168.1.2");
setsockopt(sockfd, IPPROTO_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq));

2) drop the mc group for this socket.
mreq.imr_multiaddr.s_addr = inet_addr("255.0.0.37");
mreq.imr_interface.s_addr = inet_addr("0.0.0.0");
setsockopt(sockfd, IPPROTO_IP, IP_DROP_MEMBERSHIP, &mreq, sizeof(mreq));

3) and then drop the socket, I found the mc group was still used by the dev:

netstat -g

Interface RefCnt Group
--------------- ------ ---------------------
eth2 1 255.0.0.37

Normally even though the IP_DROP_MEMBERSHIP return error, the mc group still need
to be released for the netdev when drop the socket, but this process was broken when
route default is NULL, the reason is that:

The ip_mc_leave_group() will choose the in_dev by the imr_interface.s_addr, if input addr
is NULL, the default route dev will be chosen, then the ifindex is got from the dev,
then polling the inet->mc_list and return -ENODEV, but if the default route dev is NULL,
the in_dev and ifIndex is both NULL, when polling the inet->mc_list, the mc group will be
released from the mc_list, but the dev didn't dec the refcnt for this mc group, so
when dropping the socket, the mc_list is NULL and the dev still keep this group.

v1->v2: According Hideaki's suggestion, we should align with IPv6 (RFC3493) and BSDs,
so I add the checking for the in_dev before polling the mc_list, make sure when
we remove the mc group, dec the refcnt to the real dev which was using the mc address.
The problem would never happened again.

Signed-off-by: Ding Tianhong <dingtianhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 54951194

net/ipv4/igmp.c

+6 −4

Original line number	Diff line number	Diff line
		@@ -1944,6 +1944,10 @@ int ip_mc_leave_group(struct sock sk, struct ip_mreqn imr)

		rtnl_lock();
		in_dev = ip_mc_find_dev(net, imr);
		if (!in_dev) {
		ret = -ENODEV;
		goto out;
		}
		ifindex = imr->imr_ifindex;
		for (imlp = &inet->mc_list;
		(iml = rtnl_dereference(*imlp)) != NULL;
		@@ -1961,7 +1965,6 @@ int ip_mc_leave_group(struct sock sk, struct ip_mreqn imr)

		*imlp = iml->next_rcu;

		if (in_dev)
		ip_mc_dec_group(in_dev, group);
		rtnl_unlock();
		/* decrease mem now to avoid the memleak warning */
		@@ -1969,8 +1972,7 @@ int ip_mc_leave_group(struct sock sk, struct ip_mreqn imr)
		kfree_rcu(iml, rcu);
		return 0;
		}
		if (!in_dev)
		ret = -ENODEV;
		out:
		rtnl_unlock();
		return ret;
		}

Admin message