1. Multicast skbs with ttl=0 freed, and then sent out!!!
Why did kernel not die immediately?
2. Fragmented multicasts was looped back incorrectly (all the fragments
are with different ids)
3. skb->daddr was not initialized -> IGMP_ALL_HOSTS check failed.
Alexey Kuznetsov.
--- ip_output.c Sat Jun 29 21:09:03 1996
+++ ip_output.c Sat Jun 29 21:12:40 1996
@@ -107,7 +107,7 @@
/* Recurse. The device check against IFF_LOOPBACK will stop infinite recursion */
/*printk("Loopback output queued [%lX to %lX].\n", newskb->ip_hdr->saddr,newskb->ip_hdr->daddr);*/
- ip_queue_xmit(NULL, dev, newskb, 1);
+ ip_queue_xmit(NULL, dev, newskb, 2);
}
@@ -810,6 +810,7 @@
skb->sk = sk;
skb->arp = 0;
skb->saddr = saddr;
+ skb->daddr = daddr;
skb->raddr = raddr;
skb_reserve(skb,(dev->hard_header_len+15)&~15);
data = skb_put(skb, fraglen-dev->hard_header_len);
@@ -927,7 +928,7 @@
if(sk==NULL || sk->ip_mc_loop)
{
- if(skb->daddr==IGMP_ALL_HOSTS || (dev->flags&IFF_ALLMULTI))
+ if(daddr==IGMP_ALL_HOSTS || (dev->flags&IFF_ALLMULTI))
ip_loopback(dev,skb);
else
{
@@ -950,7 +951,11 @@
*/
if(skb->ip_hdr->ttl==0)
- kfree_skb(skb, FREE_READ);
+ {
+ kfree_skb(skb, FREE_WRITE);
+ nfrags++;
+ continue;
+ }
}
#endif