|
Description
|
During Clearview IPMP development, I noticed an existing flaw in
ipif_resolver_up(): if ill_arp_off() or ill_arp_on() fail (e.g.,
because we're out of memory), we never clear ill_arp_bringup_pending:
if (err != 0) {
ip0dbg(("ipif_resolver_up: arp_on/off failed %d\n", err));
freemsg(ipif->ipif_arp_del_mp);
freemsg(ill->ill_arp_down_mp);
freemsg(ill->ill_arp_del_mapping_mp);
ipif->ipif_arp_del_mp = NULL;
ill->ill_arp_down_mp = NULL;
ill->ill_arp_del_mapping_mp = NULL;
return (err);
}
As a result, we will hold ARP hostage by not answering its
AR_ARP_CLOSING request.
|
