ip multicast bug

[Karlis Peisenieks <karlis@mt.lv>]

[-- Attachment #1: Type: text/plain, Size: 579 bytes --]

Hello,

Patch below fixes kernel crash when multicast group is joined on 
disabled interface with IP address added.

The problem is 
ip_mc_join_group->ip_mc_inc_group->igmp_group_added
->igmp_ifc_event->igmp_ifc_start_timer which does mod_timer on 
uninitialized timer_struct (mr_ifc_timer). As soon as timer fires, 
kernel crashes.

Multicast related fields of in_device are only initialized in ip_mc_up
which gets called when device is enabled.

Perhaps somebody with more clue on multicast implementation can comment 
on this fix - is this fix enough or maybe wrong.


Karlis

[-- Attachment #2: igmp.c.patch --]
[-- Type: text/plain, Size: 496 bytes --]

--- igmp.c	2 Dec 2003 08:53:00 -0000	1.1.1.7
+++ igmp.c	17 Feb 2004 15:51:58 -0000
@@ -1151,12 +1151,14 @@
 	im->next=in_dev->mc_list;
 	in_dev->mc_list=im;
 	write_unlock_bh(&in_dev->lock);
+
+	if (in_dev->dev->flags & IFF_UP) {
 #ifdef CONFIG_IP_MULTICAST
-	igmpv3_del_delrec(in_dev, im->multiaddr);
+		igmpv3_del_delrec(in_dev, im->multiaddr);
 #endif
-	igmp_group_added(im);
-	if (in_dev->dev->flags & IFF_UP)
+		igmp_group_added(im);
 		ip_rt_multicast_event(in_dev);
+	}
 out:
 	return;
 }